crew v. office of administration: regarding lost white house emails: 6/21/2007 - oa foia response

8/7/2019 CREW v. Office of Administration: Regarding Lost White House Emails: 6/21/2007 - OA FOIA Response

1/52


2/52

Privileges. OA has located potentially responsive documents that fall within those categories;and

(3) Title 5 U.S.C. 5 552(b)(6) [Personal Privacy Matters] protects the identities of Federalemployees who may be potential targets of threats and harassment. As such, there is aheightened interest in the identity and duty locations of current and former employees that isconcurrent with the increased security awareness demanded in this time of national emergency.OA has located potentially responsive documents that fall within those categories.Since this matter is in litigation, please contact Jean Lin at 202-5 14-3716 if you have anyquestions.Sincerely,

Carol EhrlichFreedom of InformationAct Officer


3/52

Exchange-ARMS Interface RequirementsExecutive Office of the PresidentExchange-AR MS Interface

RequirementsFor

The Executive OfJice of the President (EOP)

Microsoft ExchangeE-Mail System

Office of Adm inistrationInformation Systems & Technology Division

November li?"', 2002

Page 1 of 9


4/52

Exchange-ARMS Interface RequirementsExecutive Office of the President

IntroductionThe Exe cutive O ffice o f the President (EOP) is required by law to m anage and store the recordsof the daily business o f th e governm ent, including communications conducted through emailsystems.As related to em ail, there are two specific records-managem ent goals:

Search - to respond to requests for information by searching stored recordsArchive - to format records for eventual submittal to the National Archives andRecords Administration (NARA)

The prima ry em ail system at EOP is Lotus Notes, which uses a custom application to submitemail records to the Automated Record Management System (ARMS), also a customapplication. ARM S fulfills both the search and archive records-management goals.The EO P is currently deploying Microsoft Exchange with the expectation that Exchange andNotes will co-exist and interoperate fo r the foreseeable future.

3)(2)!(b)(5)


5/52

Exchange-ARMS Interface RequirementsExecutive Office of the PresidentI EO P Environment

ExchangeRecords Submittal

- - - - - - - - - - - - - -

InternetEmailGatewayServers

General Project RequirementsThe EOP expec ts that in general any solution will meet the following requirements.

The RSS must be installable by EOP personnel, and therefore all necessary softwareand installation instructions must be provided.There must be sufficient documen tation that EO P personnel can understand andmanage th e RSS.The RSS must provide sufficient reporting and administration tools such that EOPpersonnel can be satisfied of correct operation on an ongoing basis.

FunctionalRSS RequirementsThe general functional reauirements of the RSS are described in the following table.

1 Exchanae Interface I Retrieves email from Exchange. 1

Page 3 of 9

~ o r m z n ~Active Directory InterfaceARMS-Ready RepositoryARMS InterfaceRetention

Formats records in ARMS-ready format.Retrieves name and agency Information from Active DirectoryContains formatted data on disk awaiting submittal to AR MSSubmits data to ARMSData needs to be removed from the repositow


6/52

Exchange-ARM S Interface RequirementsExecutive Office of the PresidentEach o f these functions is described in h rt h e r detail below.Exch ange lnterfaceTh e RSS must obtain all email records in Exchange, including but not limited to:

Standard emailNon-delivery receiptsRead receipts

In addition, the RSS must obtain BCC information for emails. As installed, Exchange does notpreserve BCC information. The EOP has implemented a custom MAP1 field that contains BCCinformation. This method may change. Th e RSS will need to collect this BCC information.FormattingTh e RSS must format email according to a sp ecific format. Within this document, this format isreferred to as the A RMS-ready format and i s specified below.Active Directory InterfaceTh e RSS must interface with the Active Directory hosting Exchange. This is necessary toresolve email addresses to hum an-readable names whenever possible, and also to include EOPagency designation for each user, which is stored in Active Directory.ARMS-Ready RepositoryTh e ARMS-Ready Repository consists of data on disk ready to be submitted to ARM S. Itconsi sts of a structure of directories and files. This directory structure is described below underARMS-Ready Format.ARM S lnterfaceTh e RSS must submit data to ARMS on a regular basis. This is further described below underAR MS Submittal Process.ARMS-Ready FormatARMS-Ready RepositoryRecord s formatted for ARMS must be placed in the ARM S-Ready Repository, which is simply adirectory on disk structured as follows.Within the repository there are three levels o f directories, which for purposes o f this discussionwill be referred to as level 1, level 2, and level 3. The highest level, level 1, consists o f a serieso f directories named in the form YYYY MM DDH HM MSS, such that the directory name isderiv ed from a date and time associated with the em ail contained within, o r alternativelyassociated with the time the level 1 directory was created. In the diagram below these level 1directories are referred to as Level-1-Dir-1, Level-1-Dir-2, and Level-1-Dir-3, bu t these are

Page 4 of 9


7/52

Exchange-ARMS Interface RequirementsExecutive Office of the Presidentplaceholders: the actual directories on disk must be the 14-character numeric nam es describedabove.The second level of directories, the level 2 directories, consists of three directories in each of thelevel 1 directories. The level 2 directories are named ATTA CH, HEA DER , and MESSAGE.The third level of directories, the level 3 directories, con sists of one hundred directories in eachof the level 3 directories, named in the format Dn, w here n is a number from 0 to 99.The following diagram depicts the directory structure:

Level-1-Dir-1ATTACH

DOD l...D99

HEADERDOD l...D99

MESSAGEDOD l

ARMS-Ready FilesA single email is broken up into som e number of files, as follows:

A s ingle header fileA sing le message fileZero o r more attachment files

Header File NamesThe header file is named a s follows:

Email-ldentljier,hdr

Page 5 of 9


8/52

Exchange-A RM S Interface RequirementsExecutive O ffice of the PresidentWhere Email-Identzjier is a filename guaranteed to uniquely identify a single email within theformatting server within its lifetime of operation. A possible solution would be to generate theEmail-Identifier by a combination of a Y YYYM MDDH HMM SS time stamp and a sequentialcomponent.Message File NamesTh e message file is named as follows:

Email-Ident~$er,msgWhere Email-Identifier is a s specified above.Attachment File NamesAttachment files are named as follows:

Email-Identifier-File-Extension .CounterWhere

Email-Identz3er - is as specified aboveFile-Extensiorr - is the zero or more characters to th e right of the right-mostperiod (.) in the original attachment file nameCounter - is a three-digit string from the series 001 ... 999. As anexample, an email with 3 attachm ents would use 001,002,and 003.

Rela tionship between files and directories within the ARMS-ReadyRepositoryA given ernail is broken up into its component parts as described above. Within the level-1directory associated with tha t em ail, the component parts will be placed within the level-2 andlevel-3 directories such that attachments, header files, and message files are under thecorresponding ATTACH, HEADER, and MES SAGE level-2 directories, and all the componentso f a single email reside within level-3 directories of the same nam e.With in all o f the level-3 directories associated with a single level-1 directory, emails are placedin the IeveI-3 directories in round-robin fashion in the order DO, D l . . .D99.ARMS-Ready File StructuresAttachment FilesARMS -ready attachment files contain on a one-for-one basis the attachm ents from the originalemail. The contents are the sam e, although the file names change.Header FilesAR MS -ready header files contain all information associated with an email such as the sender, therecipient list, the subject, and all other email information, as well as information such as theattachment and message file names.

Page 6 of 9


9/52

Exchange-ARMS Interface RequirementsExecutive Office of the PresidentTh e header file is a single f ile composed of a series of fields described in the table below.

Header LengthHost Message Filename

Message Time

Record TypeBody T v ~ eTransaction Type

4 byte Size of header in bytesunsignedI 25 6 String Nserver:[dimame.dx]messagefilename

I I N: the literal character 'N"I I server: name of serverI I dimame: MESSAGEI ( dx: W...D99I I messagefilename: file name of the associatedmessageI I Note: padded with spaces to 256 charactersI String I YWYMMDDHHMMSSHH

A single byte with the value of 1unsigned Note: not the character '1"

11

Source Identification

CharChar

The time containe d in the MAP I fieldPR-MESSAGE-DELIVERY-TIME expressedin the format above. HH (hundredths ofseconds) may be 00. There must be a methodof dealing with emails with a blank or non-existent PR-MESSAGE-DELIVERY-TIME.'F""E"

FillerTAG-CREATOR

From

391

TAG-CREATOR LengthTAG-CREATOR Length2

A two-byte value as follows:unsigned

I 450 (MS Mail) I1 451 (MS Delive ry Receipt) II 452 (MS Waves Request) II 453 (MS Non-Delivery) IString1 byteunsigned

Intelligent Nam e- human-readable nameresolved from AD, if unresolveable spedfy asUnknown.

454 (MS Calendar)Filled with sp acesA single byte with the value of 11 1

2 byteunsignedString

1 Address -addres s string from email I

Length of From fieldIntelligentName (Address [Age ncy 1)

Agency -Agen cy code resolve d from AD, ifunresolvable, use 'Unknown". INote that in the construct '[ Agency ]" there is aspace befo re and a space after the agency

Page 7 of 9


10/52

Exchange-AR MS Interface RequirementsExecutive Office of the President

The fields described in the table above are organized within the file into a fixed part and a variantpart. Th e fixed part comes first in the file and is comprised of the following fields: HeaderLength, Host Message Filename, Message T ime, Record T ype, Bod y Type; Transaction Type,

TAG-CC-ADDRESSEELengthCopyTo

TAG-BCC-ADDRESSEETAG-BCC-ADDRESSEELengthBlindCopyTo

TAG-ATT-FILENAME

TAG-ATT-FILENAMELengthHost AttachmentFilename

TAG-DONE-AT1TAG-DONE-A77 Length

Done

Page 8 of 9

2TAG-CC-ADDRESSEELength12

TAG-BCC-ADDRESSEELength1

2TAG-ATT-FILENAMELength

1 byte1 byte

4 bytes

2 byteunsignedString

1 byteunsigned2 byteunsignedString

Ibyteunsigned2 byteunsignedString

1byteunsigned2 bytesunsignedString

Length of C opyTo fieldIntelligentName (Address I Agency I )See the From field110Length of BlindCopyTo fieldIntelligentName (Address [ Agency 1)See the From field107

Length of H ost Attachment Filena me fieldNserver:[dimame.dx]attachfilenameN: the litera l character "N"server: identifier of serverdirname: ATTACHdx: DO...D99attachfilename : file nam e of the associatedattachment1124

The litera l string "DONE"


11/52

Exchange-ARMS Interface RequirementsExecutive Office of the PresidentSource Identification, and Filler. These fields are always present, are always at the beginning ofthe file, and are always in this order.The remaind er of the fields comprise the variant part. Each field in the variant part is onlypresent if needed. For instance, if a particular email has CC recipients then the fieldsTAG-CC-ADDRESSEE, TAG-CC-ADDRESSEE Length, and CopyTo will be present. Ifthere are no C C recipients then the fields are omitted. Note that fields having to do with thesender and th e subject, while technically variable, will in practice always be present. The fieldsin the variant part can be repeated as many times a s needed. For instance, f there are five CCrecipients then the TAG-CC-ADDRESSEE, TAG-CC-ADDRESSEE Length, and CopyTofields will be repeated five times. In genera l, the fields in the variant part should be in the orderlisted in the table.Th e last three fields listed in the table above , TAG-DONE ATT, TAG-DONE-ATT Length,and D one, should only be present if there are attachment fields, and should follow all attachmentfields.Finally, in t he table above, the Type column specifies what data type for each field. Note thatthe data types listed are either one-, two-, or four-byte numbers, or strings. String s are a series ofcharacters, without a termination character, with the length of the string taken from the previousfield.ARMS Subm ittal ProcessOn som e interval, such a s daily, the RSS must submit the contents of zero or more first-leveldirectories to the ARMS system. This is accomplished by copying the contents of eachsubmitted first-level directory into a local directory path which is mapped to the ARMS system.The submittal must be logged, so that all first-level directories successfully copied are logged assuch, an y directories which fail to copy in their entirety are noted, and any directories that copypartially a re noted, including what copied and wha t failed to copy.Each em ail must be copied such that the message and attachment portions are copied first, andthe heade r portion is copied last.Each email must be copied as an atomic transaction such that if the header fa ils to copy the emailis cons idered to have failed to copy.Data RetentionAt som e point, data in the repository which has been successfully received by ARMS must bedeleted.

Page 9 of 9


12/52

EOP ELECTRONICCOMMUNICATIONS

THEEXECUTIVEOFFICEOF THE PRESIDENTOFFICEOF ADM~NISTRATIONOFFICEOF THE CHIEFINFORMATIONOFFICER

EOP-OA-OCIO-CRBSE - FO RO F F I C ~ A LUSEONLI .


13/52

DOCUMENTIDVERSION

FILENAMEREVISION DATEOWNER

DEsCRIPT~ON

EOP-OA-OCIO-ECRMS-SOW .~ 0 6EOP-OA-OCIO-CR&SE-ECRMS-SOW- v06Tuesday, June 24,200 3 - 4:07:00 PMThe Executive O fi c e of the PresidentOffice of Adm inistrationOffice of the Chief Information OfficerEOP Electronic Communications Records ManagementSystem Statement of Work


14/52

1.0 introduction.................................................................................................................... I....................................................................................................................................1 .) ldentificalion 1

1.2 Organization ....................................................................................................................................11.2.1 The Executive Office of the President ........................................................................ 1I .2.2 The Office of A dministration ..................................................................................... II .2.3 The Office of Chief Information Officer .................................................................... I

3......................................................................................................................................1 .3 Background ,..................................................................................................................................1.4 Current System 2

1.5 Heed for Change ........................................................................................................................ 31.6 Targetsystem ............................................................................................................................. 3

2.0 Statement of Work .........................................................................................................72.1 Scope.............................................................................................................................................7

...........................................................................................................................2.2 Statemen t of Work 82.2.1 Task I - Project Plan of Action ..................................................................................82.2.2 Task 2 - Requirements Specification and Analysis .................................................... 82.2.3 Task 3 - Market Survey and Candidate Solution Analysis ........................................92.2.4 Task 4 - Solution Design .......................................................................................10................................................3.0 Project Management and Description of Deliverables 11

3 . I Status Reporting .............................................................................................................................1 13.2 Work Effort Earned-Value Status Reporting ........................................................................... 1 13.3 Form and F ormat of Deliverables .............................................................................................. 123.4 Delivery and Review Process ......................................................................................................... 12

4.0 Constraints and Other Administrative Considerations ..............................................13..................................................................................................................4.1 Period o f Performanc e 13............................................................................................4.2 ~u th o r i t i e soEGovernment Personnel 13

4.3 place of Performance .................................................................................................................I 34.4 Non-Disclosure ............................................................................................................................13

......................................................................................................................4.5 Contractor Personnel 14.....................................................................................4.6 Government Furnished Equipment (GFE) 14

4.7 ~d v e r t i s i n gof Award ..................................................................................................................... 154.8 Ownership of Documentation, Source C ode and Data ...................................................................154.9 Privacy and Security Safeg uards ....................................................................................................15

.........................................................................................................................4 .10 Computer Sec urity 164.1 1 Limited Distribution and Us e of Information ................................................................................164.1 2 Standards of C onduct .....................................................................................................................154.13 Federal Government Holidays ......................................................................................................I 74.14 Disclosure of Concurrent Work Effons .........................................................................................I F

.........................................................................................................4.15 Potewial Conflicts o f Interest 16.....................................................................................................................4 . 1 6 Invoice Requirem ents I T ;

.....................................................................4 .] 7 Travel and Charges :..................................................16


15/52

1.1 IdentificationThis document is the Statement of Work for Executive Office of the President (EOP) ElectronicCommunica~jonsReco rds M anagement System (ECRMS).1.2 Organization1.2.1 Th e Exec utive Office of the PresidentThe Executive Office of the President (EOP) was formally established in 1939 by Executive Order 8248.The current organizational structure of the EOP is a group of organizations that provide policy andadministrative support to the President of the United States.Each component of the EOP has a unique mission and goals, which supports the activities, policies andpriorities o f the Pres ident. Because of the nature o f the organization, no forma l hierarchical structureexists. In most ca ses, each agency and office within the EOP has its own director, mission and budget.The prior ides o f each are consistent with the policies and priorities of the Preside nt. The Office ofAdministration is responsible for providing common administrative support and services to allcomponents of the EOP.1.2.2 The Office o f AdministrationThe O ffice o f Administration (OA) was formally established by E xecutive Order 12028on December 12,1977, Its mission is to provide com mon adm inistrative support and service s to all unit s within the EOP,except for services provided primarily in support of the President. OA w ill assist the Wh ite House Officein performing its role of providing those administrative services which are primarily in direct support ofthe President. Th e Director of the OA has overall ,management responsibilities for OA , which includescoordination o f policies and priorities.1.2.3 Th e Oflice o f Ch ief Information OfficerWithin the OA, all information rechnology (IT) support for the EOP is provided by the Chief InformationOfficer's (C1 0) Organization. The Office of the CIO is organized into three directorate s, lnformationAssurance (IA), Concepts, Requirements, and System Engineering (CRSE), and Information Systems andTechnology (lS&T). These directorates handle IT security, new sys tems architecture & engineering, anddevelopment & sustainment of the production IT environment across all offices of the EOP and others asassigned by the Director of the Office of Administration.


16/52

1.3 Backgr oundThe Automated Records Management System (ARMS) is the system currently in use by the EOP for themanagem ent o f electronic records. This system was implemented in 1994 as a solution for the retentionand man agem ent o f electronic communications (primarily E-mail messages) for the EOP. The purpose ofthe ARMS system was to meet the requirements set forth in the Presidential Records Act (PRA), theFederal Records Act (FRA) and various Federal court decisions. The current system w as created to get i topera tional as qu ick ly as possible. Many technology and design decisions were ma de based on thetechnical expertise, tools and systems that were present-at-hand within the EOP at that time.The current electronic records management environment was developed and deployed to meet an urgentneed to pres erve E-ma il records. The system was never intended to be the long-term strategic solution.Because it was not the ultimate system, decisions were made to accept additional operational risks,recognizing that the se risks would be addressed in the implementation of the ultimate system. Th eanalysis and review of the operational risk factors of the current environment resulted in the decision bythe OA to replac e th e system with a more appropriate, stable and exp andable solution.1.4 Current SystemThe ARMS system is a ke y component of the current overall electronic records m anagemen t approach ofthe EOP. Other sy stems and system components have been implemented to provide the transport andinterface me cha nism s from other record producing system s (E-mail systems) to ARM S. This complimentof systems is used for the collection, retention and processing of E-mail messages that originate or arereceived by the EOP.The EOP ARMS system was designed to manage, store, search, monitor, retrieve and dispose ofelectronic records, primarily E-mail messages and anachm ents. Separate system components have beendesigned to capture all inbound E-mail messages received by EOP staff and to capture all E-mailmessages originated by EO P staff. The categorization of an E-mail message as Presidential record orFedera] record i s determined by the agency or oflice of the originator and recipient o f the message. Thesystem is intended to support the storage of the retained records for an extended period of time (e.g. atwo-term administratjon) and to support the physical separation in the storage of Presidential and Federalrecords.ARMS and its associated systems are installed on various servers within the EOP E-mail systemsenvironment and data center server environment. Th e current functions of these systems (ARMS and theassociated supporting sy stems) include:

Retention of all in-bound E-mail messages that are received by EOP users from sourcesexternal to the EOPRetention of all EOP staff originated E-mails messages (created in the ~ o t u sNotes E-mail environment a nd other E-mail enviro nme nts that include an interface for ARMS )Collec ting and reformatting of retained E-mail m essa ges for storage in the systemCataloging and separation of the retained E-mail messages by an EOP office (for theeffective separation o f presidential records and federal rec ords)Long-term storage o f the retained recordsMonitoring of the records in the system

r Retrieval of records stored in the syslem to satisfy various types of search and retrievalrequests (Freedom of Information A ct (FOIA), subpoena, congressional)Creation of magnetic tapes for the rransfer of records to the National Archives andRec ords Administration (NARA)

I I W E 74 3013: EOP-OA-OCIO-CRBSE - FOROFFICIALUS EO m ? PAGL::


17/52

bEOP EL R O N ~ CCOMMUNICATIONSRECORDS SYSTEM- STATEMENTOFWORKThe EOP currently uses two E-mail platforms, Lotus Notes and Microsoft OutlookExchange. Thecurrent ARMS implementation suppons the retention and processing of E-mail records from the LotusNotes E-mail environment. A project is currently underway to provide an interface from the MicrosoftOutlooWExchange E-mail platform to the ARMS environment.The current electronic records management system includes ARMS and a number of ancillary systems toprovide data to AR M S . These are installed on servers within the EOP E-mail and data center serverenvironment. T h e system is managed and maintained by staff members of the Office of the ChiefInformation Officer with the day-to-day operations support provided by data center operations contractpersonnel. The sys tem processes between 1 and 1.5 million E-mail messages per month with anaggregate total si ze o f between I50 and 200 GB.1.5 Need f o r ChangeSeveral factors h av e caused this examination of the current electronic records manage ment capabilities ofthe EO P are numero us. The most significant of these include:

A more fo cused awareness o f the operating risks of the current systemTh e need for greate r flexibility in supporting other types of electronic recordsNew requirements and procedures that have been o r will b e promulgated by NARA andthe need t o have th e ability and flexibility to support these requirements

r Increase av ailabilit y o f Commercial-Off-The-Shelf (COTS ) products that may meet manyo f the electronic records management requirements of the EOPDesired alignment with the new EOP IT Strategy and Enterprise Architecture (EA)

The EOP is required to supp ort a complex and unique set of electronic records manageme nt requirements.Although the current EOP electronic records management environment may provide support for many ofthese requirements, it does not support them in a manner that is consistent with current systemsengineering principles and practice. This situation, along with new requiremen ts and the increasing useof electronjc communications and electronic documents within the EOP requires action to be taken toensure that adequate support is provided to meet the electronic managem ent needs of the EOP.1.6 Tar get SystemThe new Electronic Comrnunicatjons Records Management Systems (ECRMS) will be implemented tosupport the legal, regulatory and policy requirements regarding the collection, management and use, anddisposal of electronic records within the EOP and the White Ho use. The primary g oal of this effort is toprovide an efficient and effective solution to meet the current Electronic Records Managementrequirements of the EOP.At a high level the target system shall include, or account for, the follo wing desired features:

Commercial Off-The-Shelf (COTS) solution is the preferred. A custom-developedsolution will be used only when warranted and justified (or when COTS so lutions are notavailable)Support for the collection and records management of all inb ound, outbound and internalelectronic messagesImplemented on a commercially trusted platformFlexible environment that allows for the addition of new types of electronic recordsUse of industry standard data mechanisms (e.g. XML)


18/52

bEOP EL RONICCOAIM~~ICATIOYSRECORDSFlexible integration with various types of systems that are the source of the electronicrecordsSupport for various types of electronic records (E-mail, E-mail with attachments,ele ctr on ic documen t, instant messaging, image. audio and video, etc.)Supp ort f o r various types of electronic formats including all word processor, spreadsheet,presentation and other widely used document formats (Microsoft Word, Excel,Po we rpo int, Adobe PDF, Postscript, etc.)FIexible web-based user interface for adminislration, searching and reportingEfficient sea rch m echanism for simple and advanced searches, including the searching ofattachmentsAcc epta ble performance for processing retrieval requestsMa nag em ent reporting capabilitiesRobust production quality operational model that provides effective operations supponme cha nism s and processes to ensure the completeness of the retained recordsSecurity architecture that is compliant with the EOP Information Assurance SecurityPolicy an d industry best practices

= Policy and role based system access and authorization support to provide fine-grainedaccess suppo rt to users and user groupsA standard platform that is consjslent with the EOP Enterprise Architecture principlesand standard s and aligned with related Capital Investment Plan (CIP) projectsCom plete data and activity audit trail supportExtraction and electronic data transfer features that allow for the delivery of specificrecord s t o sa tisfy retrieval requestsScalable platform that will support the increasing volume o f electronic record s

= DoD 5015.2 Certified platformIntegrate d system recovery and rollback capabilitiesSupport for a high-availability, fault-tolerant and intrusion-tolerant environments.Supp ort fo r the business resumption and disa ster recovery environment of the EOP

These high-level features are only a representative set o f the features, requirem ents and constraints of theelectronic record s management environment for the EOP. Information related to the EOP lnformation~ s s u r a n c eSecurity Policy and the EOP Enterprise Architecture will be provided for use during thisengag emen t. Th e detailed definition and analysis of the legal, regulatory and b usiness requirements ofthe system, as well as the assignment of priorities for these requirements will be determined during therequirem ents analysis process.


19/52

CEOP EL~LTRONICCOMMUNICATIONSRECORDS SYSTEM- STATEMENTOFWORKThe follow ing is a high level context model of the significant components and functions of the system. Itis not intended to be a complete representation of the system. A complete contact model will becompleted as part of the system design process.

E-mail FROM Memat SourceandTO External Destinatiom

Proposed EOP Electronic Communication R ecordsManagement System - Context Model - March 2003

Nohr MaY I n v i r o ~

ECRFIS

0uUIPL / .c)unpc 09rm(MsY Em*onnxn( RCqYLItCr(uapoau)

- L.......................... mu

Enterprise M-ginp ;. RIData......Environment (Future) ..........................-

.......Eleclronic Document ; .:Colkbar atwn (Future) *................................................... om*-Rcoam.......Ofhcr Electronic R e c d r , .:Svstcm (Future)

A COTS (or GOT S) solution is the preferred solution. The reasons for this position include:Custom-developed solutions are used only when warranted and justified (or when COTSsolutjons are not available)COT S solutions provide wider platform support and increase platform stabilityCOTS vendors provide better and more timely support of changes and upgrades tounderlying server, operating system and database platformsCOT S vendors specialize in application development and prov ide more thorough testingof the products and tend to provide better support for industry standard technologies, andinterface and integration mechanismsThe selection of certain certified CO TS producrs (e.g. DoD 5015.2) often times enablesus to satisfy NARA and other requirementsThe use of COTS products, which comply with the EOP Enterprise Architecture and thetechnical direction of the EOP, may significantly reduce the efion required to develop,test, and deploy the system .

1 9 ntr 7.4 301i; EOP-OA-OCIO-CRBSE- FOR OFFICIALUSE0x1)' PAGE:5


20/52

EOP ELkL T R O N I CCO~.IM~ICATIONSRECORDSIf it is determined that COTS products cannot provide the all the critical functionality necessary toad dr ess the ne ces sar y requirements. then additional analysis. requirements and product review and systemdesign may be ne cessa ry to address the deficiencies.The selection of a COTS solutio n does not eliminate the need for development and testing resources. Inthis work effort, careful consideration must be given to the time and skills needed to integrate COTSco mp on en ts in to th e environm ent. This includes design, implement, test and documentation of thesoftware that will suppo rt C OTS integration.


21/52

2.1 ScopeThe goal of this work effort is to provide a complete proposed solution design for the EOP ElectronicRecords M anagem ent System. The scope of this work effort DOES NO T include the implementation ofthe solutio n. T h e implementation of this proposed solution will be com pleted as a separate work effort.The procurement process for the implementation of the solution will occur after a thorough and completereview o f the solution had been completed.The major tasks for this work effort include:'

Definition of approach and a project plan of actionComplete a thorough requirements gathering, analysis and synthesis process to develop acomplete set of requirements (user, functional, non-functional, system, legal and policy)for the implementation of a new electronic records management systemPerform a market survey to identify viable candidate COTSIGOTS solutions that will beable to m eet the defined requirementsCom plete a detailed analysis of at least three viable candidate solutions to de termine best-fit and best value for the GovernmentWork with the Government to select the single proposed solutjonComplete a detailed solution design that will be used for the implementation of thesolution

To reiterate, the implementation of the proposed solution is not w ithin the scope of this effort. There maybe a significant gap of time between the completion of this work effort and the initiation of theimplementation phase of the proposed solution. This ga p is required bec ause of the extensive review andacceptance of the solution by numerous stakeholders within t he EOP and other external agencies.At the completion of this effort, the Go vernment may request that the Contractor subm it a proposal for theimplementation of the proposed solution. At its sole discretion, the Government may accept theContractor's proposal, compete the award of the Phase I1 implementation, or complete the effort withGovernment resources.The kickoff meeting for this work effort will occur after all key Co ntractor personnel h ave received EOPsecurity clearances.Associated with each task in this Statement of Work is a proposed schedu le/duration. This schedule isdesigned to complete all the tasks and deliverables within a 6 month period. Variations to this schedulecan be proposed by the Contractor as part o f the proposal.

3 1 3 ~24.2003 EOP-OA-OCIO-CRBSE - FO RO F F I C I A LUSE0~1.1 PAGE:7


22/52

2.2 Statement of lI1ork2.2.1 T a s k I - Project Plan of ActionThe Contractor shall define the Prqiect Plan of Action that will specify and define all the activities to beperf orm ed by th e Con tractor in support of this work effon. This Project Plan of Action document shallde fin e in detail th e Contractor's approach and methodology. Existing Contraclor methodology supportmateri'al shou ld b e included to support the chosen methodology. The project plan sha ll include a workbreakdown structure (WBS level 3) of all tasks and milestones included in the effort, the dependenciesbetw een task s, th e estimated duration of each task and the resources assigned to each task. The ProjectPlan of Action shall also include a detailed description of the form and contents proposed for eachdeliverable set forth in this statement of work.1 Deliverable: 1 1- .. .- --

i Description: 1 Draft Project Plan of Action Document and Project Plan jI

/livery: / 5 business days after Project Kickoff Meeting ] ..---

I Deliverable: / 2 8jI I7~-Description:2.2.2 T a s k 2 - Requirements Specification and Analysis

/Final Project Plan of Action Document and Project Plan :/ Target Delivery:i

The Contractor shall perform a complete and thorough requirements gathering and analysis process inord er to ca pture all the requirements of the system, as well as all constraints (system , legal, policy) thatar e placed on the system. The deliverable of this task is a complete and defined set of user, system,func tion al and non-functional requirements. Th e use of industry accepted stan dard s and practices for thespecjficatjon of system requirements is expected. The Contractiing Officer's Technical Representative(COTR) will assist the Contractor in the scheduling of all meetings and interview with key stakeholdersnecessary for the efficient and effective completion of this task by the C ontractor.

3 business days after receipt of Government's comm ents on DraftProject Plan of Action Document and Project Plan

I) Deliverable: 1 3, !- -- "-: Description: I Draft System Requ irements Specification+.__ -----.--- * -.-.-..--.----A,...-.-..

1 35 business days after acceptanc e of Project Plan of Action andi Target Delivery: ! Project Plan

The Contractor shall conduct a face-to-face detailed walk-through and inspection of the Draft SystemRequ irements Specification. This shall be appropriately scheduled to en sure key Governm ent stakeholderpan icjpa tion. The comments, issues and concerns thar are the result of this walk-through and the reviewof other stakeholders shall be laken under consideration and review by the Contractor and. whenappropria te, the Contractor shall address these in the final deliverab le.


23/52

Deliverable: 1 4,-- IDescription: 1 Final System Requirements Specification- --- ---! / 5 business days afier walk-through and inspection of Draft System

i Target Delivery: : Requirements Specification 12.2.3 Task 3 -Marke t Survey and Candidate Solution Analysis

i The Contractor shall perform a market survey to identify viable candidate COTSIGOTS solutions thatwill be ab le to me et th e defined requirements. From the results of this survey the Con tacto r shall define at]east three v iable can did ate solutions and complete a detailed analysis to determine best-fit and best valuefor the Governm ent.The task shall include (but is not limited to) validation of requirements with each solutions, analysis oftotal cost of ownership (initial startup costs and ongoing support and maintenance) of the solution, reviewand assessment of financial viability of COTS vendor, trade-off analysis of the solution against therequirements, the stability and installed base of the COTS product and the technology fit in the EOPenterprise infrastructu re.

rj Deliverable:I1 Description:I/ Target Delivery:I

1 5 business days after the walk-through and review o f the DraftTarget Delivery: / Market Survey and Solu tion Analysis II

5Draft Market Survey and Solution Analysis25 business days after the completion of the System RequirementsSpecification

The Contractor shall conduct a face-to-face detailed walk-through and review of the Draft Market surveyand Solution Analysis. This shall be appropriately scheduled to ensure key Govern ment stakeholderparticipation. The com ments, issues and concerns that are the result of this walk-throug h and the reviewof other stakeholders shall be taken under consideration and review by the Contractor and, whenappropriate, the Contractor shall address these in the final deliverable.

--- - .--- --- -- --- -- ,The Government shall notify the Contractor regarding the Government's decision of the solutionselection. In the case whe re no solution is suitable, Task 4 will not be executed by the Contractor.

i

ri Deliverable:;r-I Description:

~ L W E24 . 200.' EOP-OA-OCIO-CR&SE - FOR OFFICIALUSEOSL) PAGE:9

6 IFinal Market Survey and S olution Analysis 1

t------ 1I


24/52

2.2.4 Task 4 - Solution DesignTh e Contractor sh all complete a solution design based upon the Governm ent's solution selection decision.The design shall be consistent with the EOP Systems Development Life Cycle and industry acceptedsystem design pract ices

1 Deliverable: 7i--- -.--.- -..-...- -... . -.- --,.,Description: i Draft Solution Design; _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ . . . _ ., .... ..

i 25 business days after the notification of the Governmen t's decisioni Target Delively: !I I of th e solution selection

I ------- -.-.---I Deliverable: 1 8-----.. --.Description: 1 EO P Electronic Records Management So lution Design5 business days after the walk-through and review of the Draft/ Target Delively: !Solution Design !i

The solution design will be used for rhe jmplementation of the solution. It should clearly identify theareas of customization and the magnitude of customization effort that is required for the implementationof the solution.


25/52

EOPELECTRONICC O M M ~ I C A T I O N SRECORDSMANAGEMbf SYSTEM- STATEMENTOF WO K

3.1 Status Report ingThe Contractor shall provide weekly wrinen slams reports to the Government to report activitiescompleted during the reporting period, the planned near term activities for the next reporting period andto track issues and action items necessary for the effective management ofthe work effort.Th e status report sh all include the following:

a. List and description of accomplishments that occurred during the reporting periodb. Planned work for the next reportingc. List and statu s of all outstanding project managem ent issues, problems and action itemsd. All kno wn changes to the project schedu le

The reporting per iod shall be from Monday through Sunday. The weekly status report shall be deliveredevery Monday by 12:OO Noon and the reporting period shall be for the week that was just com pleted. Ifthe report delivery date falls on a holiday, the report shall be delivered .on the first business day after theholiday . The rep ort shall be delivered via E-mail to the Contracting Offic er and the Contracting Oficer'sTechnical Representative.3.2 .W ork Effort Earned-Value Status ReportingThe Contractor will provide the following information, in the format prescribed below. This should bereported on a calendar month basis and should be delivered by the 5Ih day of the subsequ ent month. Thereport shall be delivered via E-mail to the Contracting Officer and the Contracting Officer's TechnicalRepresentative.The Contractor will provide the following (in graph form):

a. Graph # 1 - Work Effort Hours - The budgeted work hours to be performed allocatedacross the current work effort schedule; and on the same graph the actual work hoursperformed allocated across the current work effort schedule.b. Graph #2 - Work Effort Costs - The budgeted cost of work to be performed allocatedacross the work effort schedule; and on the same graph the actual cost of work performedallocated across the work effort schedule.

In the event the actual cost or hours of work performed exceeds the budgeted cost or hours of work to beperformed at any time, the Contractor will provide an estimate to complete for both the hours and dollars.For information, the following is provided:

a . The budgeted work to be performed is the amount of hours and dollars awarded under thecontract to accomplish the effort required under the contract. I t does not include thedollars or hours associated with unexercised options or any anticipa~edbut not awardedwork.b. The actual work performed is the amount of hours and dolla rs incurred by the Contractorto accomplish the required effort unde r the contract.c. The esrimate to complete is the hours and dollars required to complete the remainingwork effort required by the contract.

J I T E ?4.200? EOP-OA-OCIO-CRBSE - F O RO F F I C I A LL'SEO N L Y P A G E :I I


26/52

EO P ELECTRONICCOMMLWICAT~ONSRECORDS MANAGEMa1 r SYSTEM- STATEMENTOFWORK3.3 Form a n d Format of DeliverablesAll deliverables shall meet the following standards of form and format:

a. The Microsoft Office suite of products is the primary desktop office-automation environment inuse within the Office of the CIO. All documents, spreadsheets, presentation material andgrap hics im ag es should be compatible with that environment. Specifically:A11 text document and repons shall be delivered in Microsoft Word 2000 or 2002for ma t (.doc). The document file should not be password pro tected.A ll spreadsheet deliverables shall be delivered in Microsofi Excel 20 00 o r 2002form at (.XIS).A11 presentation slides shall be delivered in Microsofi Powerpoint 2000 or 2002format .A11 graphics shall be delivered in formats that are compatible with the MicrosofiWindows (NT,2000 and XP) desktop computing environments. Microsoft Visiois th e preferred graphics application for the EOP.

b. All do cum ent s shall be paginated and include a cover page that includes a title that clearlyide nti fie s the deliverable and the actual date of delivery. A11 text documents shall also include atable of contents.

c. All do cum ent s shall be written in American Eng lish, at a college reading level.d. All deliverable shall be accurate in presentation, technical content, and adherence to generallyaccepted elem ents and principles of style.e. A11 delive rab les shall be clear and concise. All diagrams sha ll be ea sy to understand and berelev ant to the supporting narrative.f. Prior to the initiation of the development of each deliverable, the Contractor shall define andprop osed the exact structure and format of the deliverable. This must be approved by theGovern ment prior to the initiation of the work effort. In some cases the Govern ment may provide

existin g templates for use by the Contracro r.g. All text documents, spreadsheets, presentations and diagrammatic files shall be edilable by theGo vern men t. The files shall not be copy protected o r password p rotected.

3.4 Delivery and Review ProcessAlong with each deliverable, the Contractor shall provide a cover letter to the Contracting Officer'sTechnical Re presentative (CO TR). A copy of the cover letter shall be sent to the Contract Officer. Thecov er letter sha ll include the title of the deliverable, the actual delivery date: the d ue date for Governmentresponse and th e Contractor's point of contact for the deliverable.The Government shall have 10 business days, or a mutually agreed upon amount of time, for the reviewof the deliverable. This period shall be reflected in the project plan. The Gov ernmen t shall identify anydeficiencies o f the deliverable in writing and forw ard this list to the Contra ctor's point of contact. TheContracror shall have 5 business days, or a period mutually agreed upon to take corrective actions anddelive r the corrected deliverable to the Governm ent. The G overnm ent has to right to review the correcteddeliverable following the schedule outlined abov e.The contractor shall deliver three printed copies and on e eleclronic copy (on CD-ROM) of eachdeliverable.


27/52

E OP ELECTRONICCOMMUNICAT~ONSRECORDSMANAGE SYSTEM- STATEMENTOFWORK

4.11 Per iod of Per formanceThe period of performance for this effort is from the date of award for a 6 month (180 calendar days)period.Within on e week o f award, the Contractor shall conduct an orientation briefing for the ~ o v e rn m e n t.Th eGovernment does not desire an elaborate orientation briefing nor does it expect the Contractor to expendsign ificant reso urces in preparation for this briefing. Rather, the intent of the briefing is to initiate thecommunication process between the Government and the Contractor by introducing key task orderparticipants and explaining their roles, reviewing communication ground rules, and assuring a comm onunderstanding of task order requirements and objectives.The Orien tation brie fing will be held at the Government's facility and both parties will mutually agreeupon the date and time. The goals of this briefing is to provide a means for the introduction of bothContractor and Government personnel performing work on this effort and to all the Contractor todemon strate their und erstanding of the work to be accomplished under this Statement o f Work.4.2 Author i t ies of Government PersonnelNotwithstanding the Contractor's responsibility for total management during the performance, theadministration of the delivery order will require maximum coordination between the EOP and theContractor. The COTR will monitor all technical aspects of the work effort. The types of actions withinthe purview of the authority of the COTR are to assure that the Contractor performs the technicalrequirements of the contract, and to notify both the Contractor and the Contracting Officer of anydeficiencies observed. A letter of designation will be issued to both the COTR and the Contractor at thetime o f delivery order award setting forth the responsibilities and limitations oft he CO TR.~t is important to note that while the COTR will be responsible for administering performance of workunder this delivery order, in no event will any understanding, agreement, modification, change order, orother matter deviating from the terms of this delivery ord er be effective or binding upon the Governmentunless proper, formal contractual documents are executed by the Contracting Of ic e r prior to completionof the delivery order.4.3 Place of PerformanceSome of the tasks for this work effort may be performed at the offices and facilities of the Contractor.For those tasks that require the direct participation by EO P staff, the principal places of performance isthe White House complex (the White House, Eisenhower Executive Office Building (EEOB),NewExecutive Office Building (NEOB)),other offices located in the vicinity of the Wh ite House and the EOPData Center facility located in the Washington DC merropolitan area. Reasonable o f ic e space will beprovided by the government to support the on-site contracr personnel necessary to support theperformance of this work effort.

4.4 Son-DisclosureThe Contractor will complete non-disclosure agreements and abide by EOP rules for non-disclosure ofinformation. The EOP will consider any unauthorized disclosu re of information a s a breach of thiscontract and justification for legal action by the gove rnme nt. Th e contra ctor must comply with PrivacyAct safeguards for the protection of all personal information unde r con tractor control.


28/52

EOP E L E CT RON I CCOMILWICATIOHSRECORDS hdA N A G E M k SYSTEM - STATEMENTOF WORK

4.5 Contr ac to r PersonnelAll data and information that is required i n the performance of this task is unclassified. However, accessto the White House Complex (including the New Executive Office Building and the EisenhowerExecutive Office Building) requires approval by the EOP Security Office. Approval is granted aftersuitabiljty is determined by considering the results from a name check performed by the Federal Bureauof Investigation (FBI). Contraciors must allow at least ten working days prior to the projected stan datefor a name check to be processed and approved by the Security Office, though the process could takelonger. It is th e Con tractor's responsibility to provide personnel who will meet E OP personnel securityrequirem ents and to ensu re that access requirements are satisfied in a timely m anner. All Contractorpersonnel must be 18 years of age and U.S.cjrizens. Contractor personnel who requ ire access to thecomplex for lo nger than 90 days MAY also be required to undergo a full field FBI investigation, andothe r backgro und investigatio ns as deemed appropriate. Contractors must provide information tocomplete the h l l field background investigation within 2 weeks after their st an date at the White HouseComplex or within 2 weeks of being notified that their work will extend for longer than a 90 day period.Permanent access (access beyond 90 days) is only granted when results of the inves tigations are reviewedand approved by officials within the EOP Security Office. Contractor personnel must provide allinfom ation requested to ensure that background investigations are properly processed.

Contractors are responsible f or ensuring that all staffa dher es to EOP check out procedures when access isno longer required. Departin g personnel must return building passes to the EOP Security O fice wherethey will obtain instructions for checking out of the complex.The Contractor will complete non-disclosure agreements and abide by EOP rules for non-djsclosure ofjnfomatjon. The EOP will consider any unauthorized disclosure of information as a breach of thiscontract and justification for legal action by the government. The contrac tor must comply with PrivacyAct safiguards for the protection of all personal information under contractor control.4.6 Government Furnished Equipment (GFE)The Ofice of the CIO will furnish telephone service, faxes, copiers, computing workstations and0peratingIoffice supplies as required for the performance o f on-site work efforts. Government equipmentshall be handled in accordance with Federal Acquisition Regulations (FAR) guidance.


29/52

I

EOP ELECTRONICCOMMUNICATIONSRECORDSMANAGE SYSTEM - STATEMENTOFWORK

4.7 Adve rt is ing of AwardThe Contractor shall not refer to this award in commercial advertising, or similar promotions in such amanner as to state or 10 imply that the product or services provided is endorsed , preferred, or is consideredsuperior to other products or services by the Executive Office of the President, the Office ofAdm inistration, th e O ffice of the Chief Information Officer, or the White House. This includesadve rtjsing o r si m il ar promotions, in all forms or electronic, broadcast, and print media.In ad dition , the Co ntr act or is strictly prohibited from reproducing the image(s) of the EOP in any form ofcomm ercial adv ert isin g or similar promotion. This includes images of official seals and buildings. Thereproduction of official seals and the images of buildings is a matter controlled by regulation andExe cutiv e Order. Any proposed usage of such symbols must be brought to the attention of theContracting Officer.4.8 Ow ner ship of Documentation, Source Code and Data

$ All doc ume ntatio n, source code and data generated, created, or initiated b y any mea ns under this contractI js the prope rty of the Federal Government, including copyright unle ss otherwise provided in writing.Relevant copie s o f code, data, and documents will be provided in electro nic format to the COTR ats completion of the related task, an d at the close out o f this work effort.

4.9 Privacy and Security SafeguardsThe contractor shall conform to standards of privacy and security as follows:

a. The details of any safeguards the Contractor may design or develop under this workeffort are the property of the Govemment and shall not be published or disclosed in anymanner without the Contracting Officer's express written consent.b. The details of any safeguards that may be revealed to the Con tracto r by the Govemmentin the course of performance under this work effort shall not be published or disclosed inany manner without the Contracting Officer's express written consent.c. Th e Government shall be afforded full, free, and uninhibited access to all facilities,installations, technical capabilities, operations, documentation, records, and databases forthe purpose of carrying out a program of inspection to ensure continued efficacy andefficiency of safeguards against threats and hazards to data security, integrity, andconfidentiality.d. If new or unanticipated threats or hazards are discovered by eith er the Governm ent or theContractor, or if existing safeguards have ceased to function, the discoverer shallimmed iately bring the situation to the attention of the other party. Mu tual agreementshall then be reached on changes or corrections to existing safeguards or institutions ofnew safeguards, with final determination of appropriateness being made by theGovernment. The Government's liability is limited to an e quitab le adjustment of cost forsuch changes or corrections, business, damage to reputation, or damages of any other

kjnd arising from discovery of new or unanticipated threats o r hazards, o r any public orprivate disclosure thereof.


30/52

E O P E L E C~RONI CCOMMUNICATIONSRECORDSMANAGEh?v T SYSTEM- STATEMENTOF WORK

4 . 10 Com put e r SecurityAll contractors accessing EOP systems shall be required to comply with all computer security policiesand practices of t h e EOP. In addition, contractor personnel who are granted special access privileges tosystem administrator funcl~onswjll be required to sign a Special Access Privileges Agreement.This agreement en su re s that privileges will not only be used for required fi~nctionalpurposes.Contractors will also ensure that the desjgn, development, maintenance and operation of any system theyare tasked to sup po rt is conducted in compliance with regulatory and EOP procedural requiremen ts. Forsystem development projects, a system specific security plan must be prepared and presented to theCOT R and In form atio n Assurance for approval prior to implementation.Unless approved b y the COTR and the Director of lnformation Assurance, the Contractor will not:

a. Load com me rcial off-the-shelf (COTS) productst custom-developed software, shareware,freeware, o r other software onto any EOP workstation or server. Modifications to thestandard softw are configurations must be approved by the 1S&T Ch ang e. Managem entCommittee prior to implementation.b. Load or imple me nt any network monitoring or scanning tools.c. Make any modification to EOP network perimeter controls (firewalls, routers, securityservers, modems, etc.)

Through the COTR, the Contractor should consult with lnformation Assurance when there is any questionconcerning EOP com pute r security policies and procedures.1 4.11 Limited Distr ibut ion and Use of Informat iont Th e contractor sha ll conform to standards of privacy and security as follows:

a. Perform ance o f this effort may require the Contra ctor to have access to and use of dataand information which may be considered proprietary by others, or which may otherwisebe of such a nature that its dissemination or use, oth er than in performance of this effort,would be adve rse to the interests of the Gov emm ent an d others.b. The Contractor agrees that Contractor personnel will not divulge or release data orinformation developed or obtained in connection with the performance of this deliveryorder until made public by the Government, except to authorized Govemment personnel,or upon written approval of the Contracting Officer. T o the extent of the work unde r thisdelivery order requires access to business confidential or financial data of others, theCon tractor shall protect data so acquired fro m unau thorized use and disc losure and agreesnot to use it for any purpose other than the perform ance of this delivery order. Th is datamay be in various forms, such as documen ts, raw photog raphic prints, compute r printoutsor it may be interpretative results derived from analysis, investigation or study efforts.Regardless of the form of this data, the Contractor agrees that neither it nor any of itsemployees shall disclose other Contractor business confidential or financial data orderivatives thereof, to third parties except as may be required in the performance of thiswork effo rt. Further, the Contractor shall not use nor copy any of this data or derivationsthereof. for the purpose other than as may be necessary in the performance of thisdelivery order.


31/52

c . The Contractor shall establish policies and procedures to implement the substance of thisClause at the individual employee level which will assure that affected employees aremade aw ar e of the delivery order provisions and the Contractor's implementing policiesand proce dures. Particu lar attention will be given to keeping employees advised of thestatues and regulations applicable to the handling of other Contractor businessconfide ntial o f financial data.d. Except a s ma y be otherwise agreed to with a data owner, the Contractor further agrees itwill not use, disclose or reproduce proprietary data belonging to others and which bears arestrictive legend, other than as required in the performance of this delivery order;provided, however, that nothing herein shall be construed as: precluding the use of anysuch data independently acquired by the Contractor without such limitation; orprohibiting an agreement at no cost to the Government between the Contractor and thedata o wn er that prov ides for greater rights to the Contractor.e. The Con tractor shall include the abov e clauses in all subcontracts.

4.12 Stan dard s of ConductTh e contractor shall conform to standards of conduct as follows:a. Con trac tor employees shall, at all times, dress appropriately fo r a profess ional officeenvironment.

b. No contra ctor employees shall solicit new business while perform ing work under thiscontract on Government premises.c. The contractor and contractor employees shall refrain from discus sion with unauthorizedpersons a ny information obtained in the performance o f work und er this contract.d. The contractor and h is h e r employees shall conduct only such busine ss as covered by thiscontract during periods paid by the Government. Business not directly related to thiscontract shall not be conduc ted on Gove rnment premises.e. Use of Government furnished equipment or records for com pan y or personal use isstrictly prohibited. Us e of Government telephones to make persona l, long distance phonecalls at the Government's expense is prohibited.f. Wh ile the contractor's employees are at the Government fac ility, the contractor isresponsible for compliance with all laws, rules, and regulations governing conduct withrespect to health, safety, and use of Government property. Thi s relates not only to thehealth and safety of contractor employees and agents, but also that of Government. personnel and other individuals. While on Government prem ises or at home and in thepossession of Government property, the contractor is responsible for such property anddama ges thereto.g. Contractor employees are expected to adhere to the high professional ethical stand ards to

which Government personnel in a comparable position would be expected to adhere. Inaddition, contractor employees must comply with the pertinent provisions of the O f i c e ofFederal Procurement Policy Act Ame ndme nts of 1987 , Pub. 1.101- 18 9,4 1 U.S.C. 423.4.13 Federal Government HolidaysThe following Government holidays are normally observed by Government personnel: New Years Day.Martin Luther King's Birthday, Presidenrial Inauguration Day (meiropolitan DC area only), President'sDay, M emorial Day, Independence Day. Labor Day, Colu n~b usDay. Veteran's Day, Thanksgiving Da!,.Chrisirnas Day and any other day desienated by Federal Statute. executive Order, andlor ~residentiH1Proclamation.


32/52

J

EO P ELECTRONICCOMMUNICATIONSRECORDS SYSTEM- STATEMENTOF WORK

4.14 Disclosure of Concurrent Work EffortsIf during the co ur se of proposing on or performing this effort, the contractor hires employe es, consultantsor subcontractors that are concurrently performing other work for the EOP, they shall notify theContractjne Officer of the contract, order or agreement and provide a listing of employees alreadyperforming o n EOP efforts.4.15 Potential Conflicts of InterestThe Con tractor 's em ployee s assigned to work on this contract have an affirmative obligation to disclose tothe Contracting Officer any personal or business relationship with Government personnel, or financialinterests, wh ich co uld present the appearance of an existing or potential conflict of interest. Failure to doso , if such b ec om es known by other means, could result in a determination o f non-responsibility prior toaward o r termin ation of contract after award.4.16 Invoice RequirementsThe Contractor shall submit invoices no more than once monthly for work completed, to the followjngaddress:Ofice: FAX: Invoices s hall be submitted to the Government office designated in the delivery order to receive invoices.To constitute a prop er invoice, the invoice must include the following inform ation and lor documentation:

a. Na me of business concern and invoice dateb. Delive ry order number o r other authorization fo r delivery of prop erty or servicesc. Des cription , price, and quantity of goods/services actually delivered or rendered for eachitem billedd. Shi ppin g and paymen t termse. Na me (where practicable, title, phone number, and com plete mailing ad dress ofrespo nsible of icia l to whom paymen t is to be sent). Th e "remit to" address mustcorrespond to the remittance address in the contractf. Oth er substantiating documentation or information as required b y the contract

The Con tractor shall only charge the Government for "Productive D irect La bor H ours'. This is defined asthose hou rs expended by contractor personnel in performing work und er this contract. This does notinclude sick leave, vacation, Government or contractor holidays, jury duty, military leave or any otherkind of administrative leave.4.17 Travel and ChargesThere is no anticipated travel expense as socia ted with this work effo rt. All trav el to and from the place ofperformance is deemed to be local ravel and will not have material charges associated with it nor accrueany personnel time charges.In the event that unforeseen travel outside of the local area is required, the contractor shall inform theCOTR of all anticipated charges 5 days before such travel occurs. Travel and per diem subsistence isrejmbursed in accordance with Federal Government travel replations.


33/52


34/52


35/52


36/52

PAGE OFI 1 I 2

GOVWORKS ( GSA Supply Center

2. ORDER NO. It

381 Elden street, MS 2510Herndon VA 20170-4817 6810 Loisdale RoadBldg A Door 17ATTN :

3. REQUISEION NO.RCI24236

1 Katherine Valltos I

4. SO LICITATION NO.

5. EFFECTIVE DATE09/24/2004

10.REQUESTING AGENCYvrrlce or Aamlnlstratlon/vCiv725 17th Street, NWWashington DC 20503

11. INVOICE OFFICEOA/ IS&T/CIPFAX INVOICES TO:(202) 395-6236FOR VENDOR INVOICE INQUIRIES,PLEASE CALL (202) 395-7259.

6. AWARD DATE09/24/2004 7. PERIOD OF PERFORMANCE8. SERVICING AGENCY~epartmentot Interior 0. DELIVER TOGSD-RDF-PO#

PO C Mack BayneTELEPHONENO. 202-395-648712. ISSUING OFFICEottice ot AdministrationCOO/Procurement Branch(202) 395-3314Washington DC 20503 USA

13. LEGISLATIVE AUTORITYSECTION 403, P.L. 103-35614.PROJECT ID

15. PROJECT TITLE

I18. ACCOUNTING DATA

17 .ITEM NO.

1002 2% GovWorks FeeI

18.SUPPLIES OR SERVICES.~elivery:09/29/2004FY: X2004 INDEX: OA3600734D22 Object: 253000Project: CI430 Sub-project: 001

3001

IPOC IS STEVE MCDEVITT AT 202-395-6403.Continued . . .Please send funding to GovWorks for theimplementation of the E-Mail Archive RetrievalSystem. See Statement of Work attached datedSeptember 21, 2004.

22.AMOUNT

23. PAYMENT PROVISIONSServicing Agency to IPAC the Receiving Agency

24. T OT AL M O U N T$410,000.00

I

268. CONT~ACTINGOFFICERLYNNAE C. ROSCOE

25a. SIGNATURE OF GOVERNMENT REPRESENTATIVE(SERVIC1NG)

25b.NAME AND TITLE 25c. DATE


37/52

PAGE2

lAA NOCIG24012 .GOVWORKS SHAL L I P AC OA FUNDS IN THE AMOUNT OF$410,000 AS FOLLOWS:Servicing Agency DUNS # 161559646OA DUNS # 031649358OA AGENCY LOCATION CODE # 11 01 0005OA APPROPRIATION CODE: 11 X 0038STANDARD GENERAL LEDGER:DEBIT: 4700 COMMITMENTSCREDIT: 4801 UNDELIVERED ORDERS UNPAIDTotal amount of award: $410,000.00.

ORDER NO


38/52

THEEXECUTIVEOFFICEOF THE PRESIDENTOFFICEOFADMINISTRATION

OFFICEOF THE CHIEFINFORMATIONOFFICER


39/52


40/52

...............................1.0 E-mail Arc hiteve Retrieval (EARS) Statement of Work .............11.1 Background ......................................................................................................................................1

...........................................................................................................................1.2 Statement of Work 11.2.1 Task 1 - Project Plan (NTE 2 weeks) ......................................................................1...........................1.2.2 Task 2 - Requirements Specification and Analysis (NTE 2 weeks) 11.2.3 Task 3 -Solution Design (IW E 4 w eeks) ...................................................................1

.....................................................1.2.4 Task 4 - System Implementation (NTE 6 weeks) 1................................1.2.5 Task 5 - Testing and Security Documentation (NTE 2 weeks) 1

1.2.6 Task 6 - Production System Implementation (N TE 6 weeks after successful..............completion of testing) ................................................................................12.0 Project Mana gem ent and Description of Deliverables ...............................................1

..............................................................................................................................2.1 Status Reporting 1...........................................................................2. 2 Work Effort Earned-Value Status Reporting 1

.................................................................................................2.3 Form and Format of Deliverables 1..........................................................................................................2.4 Delivery and R eview Process 1


41/52

1.1 BackgroundThe goal of this work effort is to implement the E-mail Archive Retrieval System (EARS) tosupport the ar chi ve and retrieval of E-mail for EOP staff and other EOP personnel. The primarygoal of this engagement is to provide EOP staff with a solution that allows them to archive,manage, search and retrieve E-mail they may want to store and presente on a long-term basis.This project is related to the Electronic Communications Records Management System(ECRM S) in tha t this project will utilize the same Commercial off the S helf (COTS) products asECRM S. This project will also commence after the implementation of ECRM S is completed.The scope of this work includes the requirements analysis, design, implementation, testing,certification and accreditation, and userladministrator.The major tasks fo r this work effort include:

Definition of approach and a project plan of actionComplete a thorough requirements gathering, analysis and synthesis process todevelop a complete set of requirements (user, functional, non-functional, system,legal and policy)Validate these requirements in light of the capabilities of the identified COTSsolution.Complete a detailed solution design that will be used for the implementation ofthe solution

The kickoff meeting for this work effort will occur after all key Contractor personnel havereceived EOP security clearances.Associated with each task in this Statement of Work is a proposed schedule/duration. Thisschedule is designed to complete all the tasks and deliverables within a 4 month period.Variations to this schedule can be proposed by the Contrac tor as part of the prop osal.1.2 Statement ofWorkThe Government requires that the contractor documen t the system in keeping with the S ystemDevelopment L ife Cycle (SDLC) documentation deliverable templates to be provided b y theEOP. Security-related documentation templates are described in the EOP Certification andAccreditation Handbook available from the OCIO Information Assurance (IA) Directorate. Thecontractor is also required to establish and install the necessa ry system' environm ents to supportdevelopment, testing and production using government furnished equipmen t. Th e contractor willimplement the solution in the EOP's production environm ent after developing Test ScriptsICasesfor and conducting Unit, System, Interface, Str ess Lo ad, Section 508.an d Security testing toensure that all of the requirements documented in the R equirements Traceability M atrix aresatisfied. The contractor is also required to develop User Acceptance Test S cripts/Cases for thegovernment to use in the final User Acceptance testing to be conducted p rior to im plementationin the production environment. The contractor is also required to setup and configure the system


42/52

' security settings based on users and groups that are to be defined during the design anddevelopment phases.The total implem entation engagement is Not-To-Exceed (NTE) 24 weeks from project kick-off.The schedule for the migration and conversion of the photographs stored in the current systemwill be d etermined at the initiation of that task.The tasks for this engagem ent are:

Task 1. Project Plan (NTE 2 weeks)Task 2. Requirements Specification and Analysis (NTE 2 weeks)Task 3. Solution Design (NTE 4 weeks)Task 4. System Implementation (NTE 6 weeks)Task 5. Testing and Security Documentation (NTE 2 weeks)Task 6 . Production Implementation and Training (NTE 4 week aftersuccessful completion of testing)

1.2.1 Task 1 - Project Plan (NTE 2 weeks)The Contractor shall define the Project Plan that will specify and define all the activities to beperformed by the Contractor in support of this work effort. This Project Plan document shalldefine in detail the Contractor's approach and methodology. Existing Contractor methodologysupport material should be included to support the chosen methodology. The project plan shallinclude a MS Project timeline/schedule with Gantt chart and work breakdown structure (WBSlevel 3) of all tasks and milestones included in the effort, the dependencies between tasks, theestimated duration of each task and the resources assigned to each task. The timelinelschedulewill also be updated weekly by the contractor to indicate percentages completed on all tasksthroughout the project. The Project Plan shall also include a detailed description of the form andcontents proposed for each deliverable set forth in this statement of work. Beyond this, thecontractor is required to develop the following documentation deliverables in this phase(working concurrently on these deliverables as appropriate):


43/52

/ Deliverable: 1 1j Descriptidn: / Draft E-mail Archive Retrieval System (EARS ) Project Plan i__.----..*ll_ ._..........__ __ __ - ITarget -,

1 5 business days after Project Kickoff MeetingDelivery: I..L_I_.-..----. . - i-A/ Deliverable: 1 2

--

Description: Archive Retrieval System (EAR S) RiskManagement Plan document

1 Deliverable: 1 3

TargetDelivery:

Final E-mail Archive Retrieval System (EARS ) RiskPlan document

2 business days after the formal acceptance o f the Final Project IPlan document and Project Plan by the Gove rnment

days after walk-through and insp ection of draft RiskPlan document --- IA

1.2.2 Task 2 - Requirements Specification and Analysis (NTE 2 weeks)The Contractor shall perform a complete and thorough requirements gathering and analysisprocess in order to capture all the requirements of the sy stem, as well as all constraints (system,legal, policy) that are placed on the system. The deliverable of this task is a complete anddefined set of user, system, functional and non-functional requirem ents. The use of industryaccepted standards and practices for the specification of system requirements is expected. TheContracting Officer's Technical Representative (COTR) will assist the Contractor in thescheduling of all meetings and interview with key stakeholders necessary for the efficient andeffective completion of this task by the Contractor.


44/52

, - .Deliverable: 5i/ Description: Draft E-mail Archive Retrieval System (EARS) System..................... Requirements Specification__ document-_----- --I

The Contractor shall conduct a face-to-face detailed walk-through and inspection of the DraftSystem Requirements Specification. This shall be appropriately scheduled to ensure keyGovernment stakeholder participation. The comments, issues and concerns that are the result ofthis walk-through and the review of other stakeholders shall be taken under consideration andreview by the Contractor and, when appropriate, the Contractor shall address these in the finaldeliverable.

TargetDelivery: 10business days after acceptance of Project Plan

1.2.3 Task 3 - Solution Design (NTE 4 weeks)

--Deliverable:--

Description:TargetDelivery:

The Contractor shall complete a system design based upon th e Governm ent's solution selectiondecision. The design shall be consistent with the EOP System D evelopment Life Cycle andindustry accepted system development practices. These docum ents shall clearly identify theareas of customization (if any) and the magnitude of the customization effort required for theimplementation of th e solution.

----6Final E-mail Archive Retrieval System (E ARS) SystemRequirements Specification document5 business days after walk-through and inspection o f DraftSystem Requirements Specification

I _ _ . _ . _ _ _ _ _ -..------I Description. 1 Final E-mail Archive Retrieval Sy stem1 document ----

Deliverable:Description:

.-TargetDelivery:---

II Target / 5 business days after the walk-through and review o f the Draft i1 Delivery: System Design documen t 1I i 2

7Draft E-mail Archive Retrieval Syste m (EARS ) System Designdocument15 business days after the notification of the Government'sdecision on the solution selection

-


45/52

1.2.4 Task 4 - System Implementation (NTE 6 weeks)The system shall b e implemen ted based on the design defined in the Final E-mail ArchiveRetrieval System (EA RS) System Design docum ent. All the hardware and software necessaryfor this implemen tation will be government furnished. Dur ing this phase, the contrac tor willinstall, setup, conf igure and perform initial system testing. The contractor will be required towork closely with government staff to complete the timely installation and configuration ofhardware and sof tware . The contractor is also required to work with the Information Assurance(IA) Directorate o f the O CIO to develop the certification and accreditation documents and todevelop and implement an EOP approved security model for system. Beyond this, the contractoris required to d evelop the following documentation deliverables in this phase (workingconcurrently on thes e de liverables as appropriate):

Description:TargetDelivery: 15 business days after acceptance of the E -mail ArchiveRetrieval System (EARS) Design Document

Deliverable: 10 7Description:

I Deliverable: I 1I I

Draft E-mail ~ r c h % Retrieval System (EARS) Test PlandocumentTargetDelivery:

-- ---115 business days after acceptance of the E -mail Archive 1Retrieval System (EAR S) Design Document 1Description:

/ Deliverable: / 12 1

Draft E-mail Archive Retrieval System (EA RS) Sy stemSecurity Plan docum entTargetDelivery:

-------I-----Description: Retrieval System (EAR S) User Manual 1

15business days after acceptance of the E-m ail ArchiveRetrieval System (EARS) Design Document 1).----- .-..____....._.-I_------Target 15 business days after acceptance of the E-mail Archive17Delivery: Retrieval System (EA RS) Design Docum ent Ii


46/52

(.._ .....__ - __ __"__I__.__._.-".^-(.-.t -I Deliverable: f i3 ---I: j j j j jj.j.jjjj jjjjjjjj -jjjjjjjjjjjj.jjjjj -jj..jj -. jjjjj.jj jjjj..jj jj..jjj.jjjj.j--.- --jjjjjj.jI Draft E-mail Archive Retrieval System (EARS) Operator's1 ~ e s c r i p t i o n dManual document

--.- -- --, 11 15 business days after acceptance of the E-mail ArchiveRetrieval System (EARS) Design DocumentL --.- -" -l- ,--.-(. Description: Final E-mail Archive ~ i t r i e v a l--.. documentTarget 5 business days after the walk-through and review of the D raftDelivery: Test Plan document

-/ Deliverable: / 16 I

p -r Deliverable:I Description:

TargetDelivery:

--15Final E-mail Archive Retrieval System (EAR S) SystemSecurity Plan document5 business days after the walk-through and review of the D raftSystem Security Plan document-- - .- -

IDescription: 1 .-Final E-mail &chive Retrieval System (EA RS) User ManualdocumentTargetI Delivery:

1.2.5 Task 5 - Testing and Security Documentation (NTE 2 weeks)

5 business days after the walk-through and review of the D raftUser Manual document.- Deliverable:

Description:Targetj Delivery:

The contractor will develop sufficient Test S cripts/Cases (System, Interface, Stress/Load,Section 50 8 and initial Security testing) to ensure that all of the requirements documented in theRequirem ents Traceability Matrix are satisfied. Th e contractor is required to conduct the actualtests outlined in the Test ScriptsICases and ensu re that all tests pass, taking co rrec tive action asrequired. Prior to implemen tation in the production environm ent, the contractor is required todevelop User Acceptance Test ScriptsICases for the government to use in the U ser Acceptancetesting to be conducted prior to implementation in the production environm ent. The User

i17Final E-mail Archive Retrieval System (EARS) Operator'sManual document5 business days after the walk-through and review of the DraftOperator's Manual document I


47/52

Acceptance Test ScriptsICases must cover all major functionality described in the S ystem DesignDescr iption and be detailed enough to give the government an acceptab le level of confidence thatthe system operates as intended and designed. Beyond this, the contractor is required to developthe following documentation deliverables in this phase (working concurrentl

crew v. office of administration: regarding lost white house emails: 6/21/2007 - oa foia response

Documents