IOWA STATE UNIVERSITY OF SCIENCE AND TECHNOLOGY

Transcription

1 IOWA STATE UNIVERSITY OF SCIENCE AND TECHNOLOGY Procurement Services Department 1340 Administrative Services Building 2221 Wanda Daley Drive Ames, Iowa FAX Date: August 31, 2018 To: From: All Vendors Eric Johnson, Procurement Agent Subject: Iowa State University Request for Proposal No Announcements: Due to the amount of questions from vendors and suppliers, the University will accept follow up questions from vendors that will be answered in an additional addendum. The deadline for follow up question submissions to will be September 6 th, 2018 at 5:00 p.m. CST. University will post an addendum with all answers to follow up questions no later than 5:00 p.m. on September 11 th, Clarifications: Supplement 3 Pricing: Vendors should use whatever Excel format they are most comfortable with using to submit pricing information Data Security Workbook: Worksheet 2 and Worksheet 3 must be filled out and returned as Supplement 5. o All documentation requested should be returned as Supplement 5 and each should be labeled for clarity. o Vendors should consider all types of data that may be within the e-discovery system at any time, providing for the most broad of scenarios with respect to data and document collection. All solutions must comply with Section 508. It is preferred that solutions be in compliance with WCAG Level 2 AA standards for digital accessibility or be in progress towards meeting those requirements. Please provide a VPAT for your solution for ISU to assess. Regarding : The desired response is that the solution being proposed is capable of data security standards for the types of data listed. For example, FERPA and FINRA information have different data classifications and are protected by specific legal statutes. The proposed solution needs to have data security standards in place that meet those legal statutes, at minimum. Answers to Vendor Questions: 1. Does ISU prefer an on-premise or cloud based solution? a. No Preference, would consider either model. Page 1 of 5

2 2. Does ISU prefer a perpetual software license with annual recurring support and maintenance or an annual subscription model? a. No preference, would consider either model. 3. Does ISU have interest in a managed services solution rather than a software purchase? a. No interest in managed services, ISU would prefer to purchase software. 4. What tools are being used by ISU for e-discovery currently? What vendors are providing support at this time? a. ISU is not currently using software tools; all discovery solutions are being handled manually. 5. Can ISU provide a typical case matter size (in file count or GB) and approximately how many active cases ISU manages annually? a. Litigation: 16 cases in previous 12 months with average of 2.4 G per case Public Record Requests: 262 requests with records provided (average of >1G per request) 6. Approximately how much data (in GB) did ISU export to a review tool or for a litigation review? a. No review tools currently used by OUC; see above response for file size. 7. How many active cases is ISU working on average at any single point in time? a. Average of 5-10 cases at any one time. 8. How many open records requests does the University receive annually? a. University received 311 requests during the previous fiscal year. 9. What are the estimated number of users? What are the profiles of those user groups? How many users/reviewers are there on a typical matter? a. OUC estimates 10 users would be needed. There are typically 3-4 reviewers on a typical matter. 10. What is the total, unfiltered, volume of data (in terabytes) in all data sources that the e-discovery solution will collect from (e.g. file shares, , SharePoint, archives, Documentum, Lotus Notes, etc; excluding desktops/laptops)? a. OUC does not anticipate needing to collect documents from any of the University s current file systems. The University will collect from those systems with current tools, migrate them to e- Discovery, and then use the e-discovery solution to perform more refined searches within the e- Discovery system. 11. Are any of the following e-discovery needs required? Legal Hold, Employee Change Monitor, PRR s, In-Place Reservation? a. Yes, all of these are preferred for this system. Solutions will still be evaluated based upon their ability to perform these functions. 12. Does this RFP include interest in physical goods, services, or software? a. If these are required to meet the scope requested they should be included in the solution proposed. 13. What is the current method being utilized for discovery collection? a. Currently OUC manually collects documents from university departments by either hard copy, or secure cloud storage. If collection requires search, OUC will coordinate search with ITS on search terms, dates, and accounts and then manually review all responsive s for production. Page 2 of 5

3 14. What service level is required for in-app chat support? (Note: Industry standard is 24/7/365 with a response rate of less than 5 minutes) a. Industry standard is acceptable. 15. What service level is required for new matter creation? (Note: Standard is less than 2 minutes) a. Industry standard is acceptable. 16. What is the scope of the projected document collection? a. See answer to Question # What is the desired contract length? a. OUC prefers a contract length of three years. Contract length may be extended or shortened based upon the solution proposed and what is in the best interest of the University. 18. Is Supplement 4 referring to the compatibility of the machine users will use to access the e-discovery platform or is it referring to the ability of the e-discovery platform to receive or collect documents that originate from these locations? a. OUC will need a full accounting of all compatible: File formats (MS Office, PDF, Google Docs, etc.) End User Operating Systems (i.e. Windows versions, Mac OS versions, ios, Android, Chrome OS, etc.) Server operating systems (Windows, Linux, Apache, etc.) Platform and infrastructure hardware necessary for running the proposed solution. File and database systems. 19. What is the University expecting from the integrations listed in Section 2.3? Should the e-discovery tool be capable of reading and writing to those integrated platforms? Are there other potential use cases in scope? a. The tool should be capable of reading from these platforms. 20. Specifically, what functionality is expected from integrations to DocuSign and Google G-Suite? a. Google G-Suite ability to read Gmail file formats. Ability to read and potentially index Docusigned documents, typically exported in PDF format. 21. Does the University have an Oracle Database License? a. OUC does not use Oracle databases. The University has Oracle database licenses but they are not in scope for this proposal. Data Security 22. Is the University expecting vendor/supplier personnel to regularly access the system and perform administration or analyst work? Or does it envision the tool only accessible by University personnel? a. This should be done by University Personnel, trained, guided and supported by the vendor. Page 3 of 5

4 23. Regarding 2.4.3, could the University better define what is meant by the term repository? Is this a search across all custodians in a matter, search across all matters, or some other functional search? a. OUC would need to be able to search across: i. All Custodians in a Matter ii. All Matters within the e-discovery system iii. All documents within the e-discovery system OUC will not need e-discovery to search any document collections or repositories outside of the e- Discovery system. 24. Regarding 2.4.7, is this in reference to activity monitoring occurring at the data source or within the e- Discovery application? a. This is in reference to activity monitoring inside the e-discovery application. Only authorized users and administrators should have access to these logs. 25. Regarding 2.4.6, could the University provide an example of what is meant by advanced routing logic.? a. Advanced Routing feature is to be able to define the conditions which will trigger transformation and routing processing or both over a file or files. Those conditions and steps are stored in so called Route Package or Route Package Template objects. Transformation steps are used to transform the file, while routing steps are used to move the transformed file out of the temporary folder. Routing logic steps includes automatic time-based reminders, reviews, escalations, tracking, approval and reporting capabilities. This helps in collaboration and approval. 26. Regarding 2.4.8, could the University expand on the intended use case for threat scanning at the document level? a. All documents should be scanned for potential virus and malware before uploading or downloading the document. 27. Regarding 2.4.9, could the University please expand on the specific document level security required? a. Document level security means that the current user's authentication information will be used to filter the results that they see on a document-by-document basis. That is, only documents that they are authorized to view will be viewable 28. Regarding , is it a requirement that the vendor be FedRamp certified? a. FedRamp preferred, but GDPR, HIPAA and FERPA compliance are required. Data need to be in datacenters located within the contiguous United States. 29. In Attachment E, please provide additional information related to: Line 6 operate in compliance with the standards. Line 20 What are the specific requirements for content monitoring and reporting on regulated data? a. FERPA, HIPAA, NIST, GDPR, Section 508 Downloads and views on regulated data, volume, user, timestamp should be monitored. Page 4 of 5

5 Please acknowledge receipt of this addendum by signing in the space provided below and return this letter with your proposal. I hereby acknowledge receipt of this addendum. Signature Date Typed or Printed Name Company Name Page 5 of 5