03 - IRPE Elements v 5.0.2 incl Monitoring ISS Tailored v2.docx

Information Resources Program Elements (IRPE) Standard Work Statement Elements

Attachment 03 – IRPE Elements v 5.0.2 incl Monitoring ISS Tailored v2

Version 5.0.2 ISS ● 11/12/2020 Part 2: IRPE Elements (requirements)

Version: 5.0.2 4 6/5/2020

Revision History

Acquisition Contractor Qualifications Contractor shall demonstrate an adherence to documented, repeatable system development, and integration processes that yield quality products and services, which is validated by a third party within 12 months of award. Contractor shall maintain that capability as a minimum during the entire contract performance period. Personnel assigned to the contract must comply with the vendor’s processes and be familiar with this contract agreement between FSA and the vendor.

Architecture Contractor Compliance with FSA Technology Standards and Products The Contractor shall ensure that the solution is defined, designed, developed, and maintained in a manner such that it aligns with the FSA Technology Standards and Products Guide in effect on the date of the solicitation. The FSA Technology Standards and Products Guide documents FSA’s enterprise technology standards and products, that should be used to build all FSA solutions. Existing software standards should be used to prevent duplication, redundancy, and incompatibility. These standards will lower costs and reduce technical complexity.

If business or technical requirements require functionality or capabilities that do not exist or replicate an existing standard, the Contractor shall seek approval for adoption of a new standard and/or request an exception to the FSA Engineering Review Board (ERB) from the CO. Refer to the FSA Technology Standards and Products Guide for additional information:

https://studentaid.ed.gov/sa/sites/default/files/fsawg/static/gw/docs/ciolibrary/Technology_Standards_and_Products_Guide.pdf

Data Center Operations Collaboration and Support For software application(s) hosted in the FSA data center(s) or in another facility that connects with the FSA data center(s)/cloud solutions through government provided networks or telecommunication services, coordination is required when adding/changing/modifying that application. The contractor shall coordinate all changes it wishes to make with all FSA IT operations and services that will be impacted by the proposed change. The contractor shall submit a written request for the change.

Technology Refreshment and Evergreening Support Contractor Support of FSA Technology Refreshment and Evergreening As part of its standard technology refreshment program (evergreening), FSA requires regularly-scheduled and periodic upgrades of the underlying infrastructure, support software, and enabling frameworks to (at minimum) N-1 versions (where N is the latest version and N-1 is the second latest version).

Evergreening of SaaS, PaaS, and/or IaaS Solutions: The Contractor performing integration services for FSA in connection with FISMA-approved cloud computing services (SaaS, PaaS, IaaS) shall ensure the infrastructure, support software, and enabling components and frameworks are maintained to (at minimum) N-1 versions as part of a standard technology refreshment program (evergreening).

Evergreening of Infrastructure and COTS Software: The Contractor shall support evergreening activities, including infrastructure and software upgrades and patches led by FSA’s infrastructure and middleware vendors. As needed, the Contractor shall regularly support planning and scheduling, impact analysis, changes to the application, and testing.

Contractor Support of Application and Enabling Components and Frameworks Evergreening

Evergreening of Applications and Enabling Components and Frameworks:To ensure that functionality and application design are optimized, maintenance is cost efficient, and the enabling technology remains under support by third party vendors (e.g. IBM, Oracle, or Microsoft),.the vendor is responsible for maintaining the application code and its underlying frameworks at the N-1 version. Refer to the Federal Student Aid Technology Standards and Products Guide for additional information.

Contractor Software Usage The Contractor shall state in its offer, the information technology assets (software name, manufacturer, version, platform, and other relevant technical specifications) that it deems necessary to provide services and deliverables outlined in the solicitation, and it shall assure its assets’ compatibility with FSA assets.

Access

Use of PIV and PIV-I Cards to Implement Multifactor Authentication PIV Card for Internally Hosted Solutions

Requirements for Personal Identity Verification Credential (PIV card) for U.S. Department of Education (ED) Educate Network and Federal Student Aid (FSA) Data Center (NGDC) Access

General Requirement: All contractors accessing ED and FSA networks and/or data centers Next Generation Data Center (NGDC) who are classified as Privileged Users (PU) are required to use government furnished Personal Identity Verification (PIV) cards for authentication and access. Note: FSA prohibits contractors from granting access to FSA systems without approval by the Department.

Reporting Requirement: Although PIV cards are issued and managed by FSA, the Contractor shall still provide a monthly PIV Card report to FSA including:

· Number of privileged users with PIV cards disabled in the last 30 days.

· Number of privileged users with PIV cards enabled in the last 30 days.

· Total number of privileged users with PIV cards.

PIV Card Readers: PIV Card Readers shall comply with the requirements specified in NIST SP800-96 and conform to the [ISO7816] standard for the card-to-reader interface. These readers shall conform to the Personal Computer/Smart Card (PC/SC) Specification [PCSC] for the reader-to-host system interface in general desktop computing environment.

How PIV Cards are issued: FSA issues PIV cards according to the following criteria:

a) If there are 25 or fewer employees performing duties as privileged user at the place of performance; AND the place of performance is located within 2.5 hours of the Department of Education Headquarters or Regional Office by motor vehicle: The individual will be required to travel to a Department of Education Headquarters or Regional Office.

b) If the number of privileged users in a place of performance exceeds 25 persons, or the place of performance exceeds a 2.5-hour trip by motor vehicle, then an ED representative will travel to the vendor’s place of performance to issue the PIV card.

FSA will not provide PIV card readers.

Additional Instructions:

Contractor shall be required to provide the following information upon request:Please ensure the following information is addressed in technical and cost proposals:

· Total number of privileged users

· A list of the user roles being considered as privileged

· A list of user roles being excluded

· Contractor / Subcontractor company name(s)

· Number of privileged users at place of performance

· Resource(s) being accessed, including location

· Current method of accessing the resource

Please refer to Appendix IRPE-E for examples of Privileged User Roles and Job Functions (All Environments).

PIV-I Card for Externally Hosted Solutions Requirements for Personal Identity Verification Interoperable (PIV-I card) Credential for Access to Federal Student Aid (FSA) Partner-Hosted Solutions General Requirement: The Contractor shall ensure that all Privileged Users who work on IT resources and applications containing or accessing FSA’s data utilize the PIV-I cards that their organization secure. The Contractor shall provide PIV-I cards, provide card readers, and require Privileged Users to use the PIV-I card for authentication and access to IT resources and applications containing or accessing FSA’s data satisfying an Identity Assurance Level (IAL3) and Authentication Assurance Level 3 (AAL3) as defined in NIST SP 800-63-3 (Level of Assurance 4 (LOA4) as defined in OMB Memorandum 04-04 and NIST 800-63-2).

There are approved and trusted 3rd Party vendors that can be contracted to provide card issuance services. The complete list of approved PIV-I vendors is available at https://www.idmanagement.gov/trust-services/

Note: FSA prohibits contractors from granting access to FSA systems without approval by the Department.

PIV-I Card Issuance Requirement:

· The Contractor shall not issue the PIV-I card to the Privileged Users of the FSA system until after FSA has approved access for these users.

Reporting Requirement: The Contractor shall provide a monthly PIV-I Card report to FSA including:

· Number of privileged users with PIV-I cards disabled in the last 30 days.

· Number of privileged users with PIV-I cards enabled in the last 30 days.

· Total number of privileged users with PIV-I cards.

PIV/PIV-I Card Readers: The Contractor shall provide PIV/PIV-I compatible Card Readers that comply with the requirements specified in NIST SP800-96 and conform to the [ISO7816] standard for the card-to-reader interface. These readers shall conform to the Personal Computer/Smart Card (PC/SC) Specification [PCSC] for the reader-to-host system interface in general desktop computing environment.

Additional Instructions:

Contractor shall be required to provide the following information upon request: Please ensure the following information is addressed in technical and cost proposals:

· Total number of privileged users

· A list of the user roles being considered as privileged

· A list of user roles being excluded

· Contractor / Subcontractor company name(s)

· Number of privileged users at place of performance

· Resource(s) being accessed, including location

· Current method of accessing the resource

· How the organization will confirm successful implementation/deployment of a system satisfying NIST 800-63-3 IAL3 and AAL3 (LOA4 per NIST 800-63-2 and OMB Memorandum 04-04) requirements.

· Level of effort (identify labor categories, labor rates (consistent with contract rates if applicable), and number of hours by labor category) required to implement and maintain IAL3 and AAL3 (LOA4 per NIST 800-63-3 and OMB M-04-04), as well as the hardware and software and other materials, if required

Note: The Contractor is advised to design procurement procedures and technical implementation for compliant system for Privileged Users (IAL3 and AAL3 per NIST SP 800-63-3 or LOA4 per OMB M-04-04 and NIST SP 800-63-2) in such a way that they can be expanded in the near future to include the Non-Privileged, general user population (your employees, contractors, and partners).

Trust

Identity Assurance

· Level of Assurance 4

· Identity Assurance Level 3 (draft NIST SP 800-63-3) l

Authenticator Assurance

· Level of Assurance 4

· Authenticator Assurance Level

Sustainability Assurance

· Favorable Adjudicated National Agency Check with Inquiries (minimum) or other Tier 1 Investigation

PIV-I Equivalent policy object identifier on PIV-I Authentication Certificates l

PIV-I Content Signing equivalent object signing certificate l

Card stock certified

PIV Application Identifier (AID)

Command edge and NIST SP 800-85 conformant

Credential Edge

RFC 4122 conformant UUID required in the GUID data element of the CHUID

RFC 4122 conformant UUID present in the Authentication Certificates

Refer to Appendix IRPE-E for:

· Examples of Technical Implementation of Compliant System using PIV/PIV-I Credentials:

· Examples of Privileged User Roles and Job Functions (All Environments):

· Other reference materials.

Contractor ED Network Access Instructions: Based on the Government’s review, section 3.2 does not apply to this solicitation.

In order to access ED network through the following websites, the Contractor must establish an ED user account and be issued a PIV card and a soft or hard token as Government-furnished Equipment (GFE.)

· Citrix environment can be accessed remotely from https://gotowork.ed.gov/vpn/index.html and http://anywhere.ed.gov/

· Citrix environment can be accessed internally on the ED network from http://citrix.ed.gov using the “ED Standard Desktop” link.

For a contractor using a Government Furnished Equipment (GFE) Laptop, the preferred method for remote access is the Aventail Virtual Private Network (VPN) connection. The Aventail VPN Connection client will be automatically pushed to each GFE laptop to enable ED users to use this service offering. The Aventail VPN Connection client allows users to connect to the ED network from remote locations and it provides an access experience very similar to that available to onsite users at ED locations.

Note: To use this feature, a contractor must be using a GFE laptop with the Aventail VPN Connection (client installed), and the contractor must be located outside the ED wired network.

Property Management Plan Please refer to FAR clause 52.245-1 Government Property and FSA local clause 45-1 Special Contract Requirements for Government Furnished Property – Two Factor Authentication Tokens (TFA) (latest version) which reads:

In addition to the requirements of FAR 52.245-1(b) – Property Management, the contractor shall:

a) Ensure the contractor’s Government Property Manager or designee shall sign a distribution letter provide by the Contracting Officer upon receipt of Government Property;

b) Comply with instruction on how to register the tokens using the Federal Student Aid Two Factor Authentication Token For FSA User Handout distributed with the tokens;

c) Seek immediate assistance with any challenges encountered with FSA CITRIX and TFA and immediately report any security or other incidents by telephone or email to the helpdesk at: 1-877-603-4188 or ed.customer.service@ed.gov and;

d) Provide a Property Management Plan to the Contracting Officer within 5 business days of receipt of the Government Furnished Property. Among other requirements required under FAR 52.245-1(b) the Property Management Plan must contain at minimum the following:

· Description on how the contractor will establish and maintain an auditable record of the token assignment to its employees by individual name and token Serial Number (AVT+9 digits, where AVT is an Active Identify time-based token);

· Method by which the contractor shall ensure that the serial number label on the back of each token remains legible and secure to the device.

· Security and management process for the physical devices and changes in assignment.

e) Upon written notification from the Contracting Officer, the contractor shall affirm its understanding of, and compliance with, the Government’s requirement for quarterly re-certification of user access and token activation. In the event of any reported security breach, without prior notice, the Government shall immediately disable or deactivate contractor access to its network.

f) Soft Tokens can be used instead of hard tokens. The soft token is an app that runs on the user’s mobile device. After downloading and registering the free Symantec VIP Access app on a phone or tablet, a user simply opens the app and a One-Time Password (OTP) is automatically generated. This one-time password is similar to a hard token. Use of a soft token is optional, however users who have a compatible mobile device are encouraged to transition to a soft token. There is no requirement to maintain property records on soft tokens.

Contact Information. For additional information on TFA or the use of a soft token, contact the TFA Support Center at 800/330-5947, option 2 (TDD/TTY 800/511-5806) or by email at TFASupport@ed.gov.

Security

Contractor Personnel Security Personnel Security Position Risk Designations The Excel document (FSA Contractor Mapping Worksheet) Contractor Position Mapping and System Access Form in Appendix IRPE-F provides a list of common job functions or position descriptions that Federal Student Aid (FSA) uses in the performance of Information Technology (IT) or IT related contracts. FSA has identified the applicable position risk designation (PRD) level for each commonly used job function or position description. The information provided is consistent with guidance provided by the National Institutes of Standards and Technology (NIST), the Federal Information Standards (FIPS) and ED’s ACS Directive OFO: 5-101 Contractor Employee Personnel Security Screenings (FIPS). Offerors are instructed to complete the following steps:

1. Offerors shall review the attached FSA Contractor Position Mapping and System Access Worksheet and determine which job functions are applicable to the scope of requirements described in the solicitation. Upon reviewing the project scope, Offerors may select some of the job functions listed, all job functions listed, or Offerors may identify other job functions they feel are necessary to perform successfully but are not included on the standardized list.

2. Offerors shall use the FSA Contractor Position Mapping and System Access Worksheet Tab A to identify all proposed contractor positions that are necessary to support the contract. Offerors shall crosswalk the job functions of each proposed position to the related FSA job function, as applicable. Since contractors do not adhere to the same position titles, FSA job functions are classified by position number rather than position title. As a result, Offerors must map their company job titles (i.e. labor categories) to FSA job functions.

3. Once all proposed contractor positions are mapped to the applicable FSA job functions, Offerors shall indicate the number of resources required for each position and propose any recommended changes to the FSA identified, system and facility access requirements. (Note: FSA designated PRDs are not negotiable.) In addition, for each proposed contractor position, Offerors shall include the position/job title(s) that your company uses to identify that function.

4. Offerors shall use the Contractor Position Mapping and System Access Worksheet Tab B to identify any additional or new contractor positions they wish to propose that are not included on Tab A. If the Offeror would like to propose additional positions, the Offeror shall use the Office of Personnel Management’s (OPM) Position Designation Automated Tool (PDT) to determine the proper designation of a position and its required corresponding level of security investigation. OPM’s position designation system consists of a four-step process that will guide the designator through an examination of the position’s duties and responsibilities. Once the Offeror has completed this process, the Offeror shall complete Tab B of the FSA Contractor Mapping Worksheet.

5. The link to the OPM tool is below:

https://www.opm.gov/suitability/suitability-executive-agent/position-designation-tool/

6. The contractor can also access the below NIST publication for further guidance on proposing additional positions: Review the NIST Special Publication 800-181, National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework, Appendix B - Work Role Detail Listing located at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-181.pdf

7. Offerors shall use the following criteria to determine which positions should be included on the FSA Contractor Mapping Worksheet: ALL positions or personnel that will require access to FSA systems and/or FSA Sensitive Personally Identifiable Information (PII) or data. In all cases, the successful Offeror is responsible for ensuring that only authorized personnel cleared under the resultant contract have access to FSA systems and/or FSA Sensitive PII or data.

8. Offerors Contractor shall submit the completed Contractor Position Mapping and System Access. FSA Contractor Mapping Worksheet. with its proposal response. The sole purpose of the required mapping is: (1) to identify the specific positions the contractor is proposing to meet FSA’s commonly used job functions or skillsets, and (2) to designate the applicable risk level for each contractor proposed position for personnel security clearances.”

Please refer to the following applicable FSA Terms and Conditions sections:

· EDAR 3452.239-70 – Internet Protocol Version 6 (IPv6)

· EDAR 3452.239-71 (Provision) – Notice to Offerors of Department Security Requirements

· EDAR 3452.239-72 – Department Security Requirements

· EDAR 3452.239-73 – Federal desktop core configuration (FDCC) compatibility

· FSA 39-2 (Provision) – Electronic and Information Technology

· FSA 39-3 – FSA Section 508 and Electronic and Information Technology Accessibility Standards Compliance

· FSA 39-4 Remedies for Contractor’s Violation of System Security Requirements

· FSA 39-5 – Monthly Vendor Employee Report

· FSA 39-7(Revision 1 or current version) – Contractor Security Responsibilities

· FSA 39-8 (Revision 1 or current version) – Supplemental Instructions to EDAR 3452.239-72, Department Security Requirements

Background Investigation Processing Metric FSA Personnel Security, in coordination with the COR, will provide initial screening and submission training to the contractor’s designated eQIP initiator(s) upon contract award. After initial training, FSA will offer periodic training based on clause 39-8, to include refresher sessions. The contractor will be responsible for completion of all required training. In addition, the contractor’s e-QIP initiators are responsible for ensuring that their employees’ background investigation packages are complete prior to sending to FSA. The contractor will comply with any service level metrics identified in the contract.

Cybersecurity Requirements Instructions: The requirement for this element is to complete Appendix IRPE-G.

Appendix IRPE-G Cybersecurity Checklist is a 6-column spreadsheet that itemizes and includes all the cybersecurity requirements to be fulfilled by the contractor. Four of the columns are used to accommodate the contractor’s responses to each requirement. The contractor must respond to each requirement by saying Yes or No. If the contractor’s response to a requirement is Yes, the contractor must state, in the adjacent column, how it will meet the requirement. If the contractor’s response is “No,” the contractor must state, in the adjacent column G to the right, why they cannot meet the requirement and, the mitigation strategy. and give the Technical proposal, and milestones, for meeting the requirement. A separate attachment is allowed.

4.3 Cybersecurity Monitoring

The Contractor shall ensure the solution is defined, designed, developed, and maintained in a manner such that it implements the cybersecurity requirements and standards.

FSA and the Department have implemented a risk-based approach and measurement methodology for each system and the information system’s cybersecurity performance under FSA contracts. The Contractor shall ensure that the FSA system and associated technologies “meets all requirements” for cybersecurity including but not limited to the cybersecurity scorecard.

The Contractor shall ensure that they fully participate, and enter in the appropriate agreements, with the FSA and Department of Homeland Security (DHS) Cyber Hygiene programs.

Development

Contractor Release of COTS Configuration and Custom Application Source Code to Government SaaS, PaaS, and/or IaaS Solutions, and/or systems hosted externally to the FSA Data Center.:: The Contractor performing integration services for FSA in connection with FISMA-approved cloud computing services (SaaS, PaaS, IaaS) will acquire for FSA any and all licenses and subscriptions necessary to meet FSA’s requirements for the use of such cloud services as specified in the contract. Ownership of such licenses may be transferred by the Contractor to FSA through the Change Management Process. FSA owned licenses shall be managed in compliance with FSA 27-2 Contractor Use of Government Commercial Software.Such licenses and subscriptions shall be transferred by the Contractor to FSA upon acquisition and managed in compliance with FSA 27-2 Contractor Use of Government Commercial Software.

COTS Licenses: For all COTS software authorized to be procured by the Contractor in performance of the contract, the Contractor will acquire for FSA any and all licenses necessary to meet FSA’s requirements, as specified in the contract, for the operation of the system. Ownership of such licenses shall may be transferred by the Contractor to FSA uponthrough the Change Management Process. acquisition and FSA owned licenses shall be managed in compliance with FSA 27-2 Contractor Use of Government Commercial Software.

COTS Configuration: The Contractor shall submit all COTS configuration information (including documentation) to FSA Task Manager or appointed Project Manager, as well as the Contracting Officer. For all COTS software configurations established and managed by the Contractor, including software configuration performed in connection with FISMA-approved cloud computing services, the contractor will provide documentation of complete COTS configuration necessary to support FSA requirements, for the continued, unrestricted use of such configurations.

The code and development artifacts shall be made available upon request to support audit and/or independent quality assurance efforts, integration, test, or other life-cycle activities.

All rights for technical data and software developed at private expense and used in the performance of the contract will be as delineated in FAR 52.227-14- Rights in Data – General and any alternates included therewith.

Test Standards The contractor shall comply with standards for test management within the Lifecycle Management Methodology. For additional information, refer to the Enterprise Test Management Standards.

https://studentaid.ed.gov/sa/sites/default/files/fsawg/static/gw/docs/ciolibrary/FSA_Enterprise_Test_Management_Standards.pdf

Performance Testing.

Externally Hosted Solutions For externally hosted solutions (such as a contractor’s facility or located in the cloud, the Contractor shall conduct performance testing of their responsible areas, and shall provide data, scenarios, volumes, support of performance testing activities, and capacity estimates, including trending of performance data, and test results. The Contractor shall resolve issues identified during performance testing activities. The Contractor shall support the testing of any interfacing application. The Contractor shall provide a document summarizing the changes associated with architecture and design of the system to support capacity planning and optimization of the performance profile of the solution.

NDGC Hosted Solutions For internally hosted solutions (such as the FSA Next Generation Data Center), the Contractor shall support FSA independent performance testing of solutions by providing data, scenarios, volumes, support of performance testing activities, and capacity estimates, including trending of performance data. The Contractor shall resolve issues identified during performance testing activities. The Contractor shall support the testing of any interfacing application. The Contractor shall provide a document summarizing the changes associated with architecture and design of the system to support capacity planning and optimization of the performance profile of the solution.

Partner Testing The contractor shall conduct and support intersystem testing between its area of responsibility and other entities that do business with FSA. The contractor shall provide resources, interface control documents, test data, and test cases/scenarios in support of intersystem testing. FSA has a weekly maintenance window that allows it to facilitate scheduled testing.

Documentation of Defects In accord with FSA's Enterprise Test Management Standards, the Contractor shall document defects found during testing. The contractor shall resolve issues identified during all phases of the inter-system testing and shall provide to the FSA its defect resolution report or documentation.

https://studentaid.ed.gov/sa/sites/default/files/fsawg/static/gw/docs/ciolibrary/FSA_Enterprise_Test_Management_Standards.pdf.

Configuration Management Plan and Activities The contractor shall develop a configuration management plan, for all systems in development and production, in accord with the standards defined in the Lifecycle Management Methodology. Refer to the Lifecycle Management Methodology section of the Federal Student Aid Technology Office IT Standards Library for additional information.

https://studentaid.ed.gov/about/contracting-info/it-standards

Independent Verification and Validation Instructions: This is only required if FSA creates a solicitation for and IV&V contractor. The Artifacts column can be used if you want to answer the time commitment in a proposal form of have some other document you wish to reference. It is not a required field.

The contractor shall support Federal Student Aid IV&V activities. Explicit deliverables of Federal Student Aid Information under the contract may include, but is not limited to, project management, technical, quality control, and quality assurance work products. Refer to the Federal Student Aid Independent Verification and Validation Handbook for additional information.

Operations Security/General Contractor shall be liable for breaches of security resulting from failure to follow FSA security processes and the federal law, guidance documents, and security standards referenced herein below in FSA Clause 39-4: Remedies for Contractor’s Violation of System Security Requirements

Contractor Employee Security Clearance Monitoring The Contractor shall comply with service level agreement measurements to facilitate prompt and effective processing of contractors’ and employees’ security clearances. See “Service Level Agreements for Contractor Employee Clearance Monitoring” in IRPE Appendix IRPE-D below.

Contractor Operations Locations Security Language Please refer to the following applicable FSA Clause:

FSA Clause 39-4: Remedies for Contractor’s Violation of System Security Requirements

Capacity Planning and Management Capacity Collaboration Requirement The contractor shall collaboratively and actively participate in FSA information technology resources capacity reviews and provide information to support: usage of current capacity; forecast for infrastructure resources including telecommunications; current and new systems to meet Federal Student Aid’s business needs Capacity Planning Requirement As per FSA directions, the Contractor will-create/revise, new and existing Information Technology Resources, including, periodic capacity-planning reports and recommendations. In order to produce a forecast and recommendations with specific sizes, quantities, types and timing, the reports and recommendations shall evaluate Information Technology Resources requirements and trends.

The contractor shall support the data center capacity planning schedule and process. The contractor will provide input relative to the performance of the application/tool and its supporting infrastructure. This will, include but not be limited to system response time and/or latency, system capacity, storage requirements, utilization, performance, etc.

Capacity Management Requirement As per the Department’s approval, the contractor shall, for all Information Technology Resources that it supports, completely monitor, and manage capacity to ensure that information technology resources are being operated within minimum and maximum thresholds.

The contractor shall produce written capacity management reports at intervals stipulated in the deliverables table, which summarize actions taken since the last report and which provide prescriptive recommendations to minimize cost and maximize efficiency.

Data Migration Planning The ISS solicitation requires the offeror to explain how they will use the EA27/EA80 process to migrate accounts to their solution. If the offeror has another Technical Solution that can either increase productivity or increase data integrity the Offeror should create a separate Alternative Migration Plan as part of their response. The offeror should include the movement of borrower data in alignment with the approved federal records schedule and in compliance with the Records Act. The plan should include both Active and Non-Active borrower data.

Data Segregation Contractor shall maintain a segregation of FSA data from all non-FSA data within its infrastructure, both in storage and during the transmission of the data. This will also be a requirement for Trusted Internet Connections (TIC), Managed Trusted Internet Protocol Services (MTIPS), and Domain Name System Security Extensions (DNSSEC).

· Physical Separation

· Contractor shall provide and maintain a physically segregated network based upon the FSA defined landing zones documented in the FSA Network Operating Standards and the function of systems operating in the FSA environment.

· Contractor shall ensure separate hardware for each landing zone to include, but not limited to network devices, routers, switches, firewalls, and load balancers.

· Contractor shall ensure virtual machines exist on physically separate equipment for each landing zone including virtual routers and switches.

· Logical Separation

· FSA data and transactions on mainframes shall be hosted in separate partitions that do not share resources with other IT users of the mainframe.

· Monitoring and reporting segregation

· The Contractor shall provide a quarterly report that identifies systems by name and IP address to identify potential problems in maintaining segregation of systems.

· The Contractor shall monthly monitor, track, and report on physical segregation to ensure it is maintained.

· The Contractor shall follow an FSA approved process for changes to network configurations.

· The Contractor shall provide a report to validate that moves, additions, and changes have been appropriately requested and implemented.

· The Contractor shall use the change-management process to identify potential security gaps in segregation maintenance and shall report status and findings quarterly.

Data Management Documentation The Contractor shall provide detailed file layouts for all production data files, loads, and extracts comprising or supporting any Federal Student Aid information system per the guidance provided in the Federal Student Aid Data Standardization Policies and Procedures in effect at the time of the solicitation. Additionally, the contractor shall include detailed source target mapping, conceptual (where applicable), logical and physical data models, and detailed data dictionaries for all production database structures per the guidance provided in Federal Student Aid Data Model Standards and Guidelines, Registration Policies and Procedures, and Federal Student Aid Enterprise Data Dictionary Standards in effect at the time of the solicitation.

Network Management The contractor shall request by written submittal all telecommunications requirements and changes through the Federal Student Aid Enterprise Change Management (ECM) process. All communication changes, new or existing, shall conform to Federal Student Aid Security standards and shall undergo security reviews. All applications and infrastructure residing in or connecting to an FSA data center shall be IPV6 compatible and compliant.

Software Licensing and Technical Data Rights and Management Please refer to the following FAR and FSA clauses as determined applicable by the Contracting Officer and included elsewhere in the contract:

· FAR Provision 52.227-15 – Representation of Limited Rights Data and Restricted Computer Software

· FAR Clause 52.227-14 – Rights in Data - General and the following alternates to 52.227-14

· Alternate II – If contractor represents that limited rights data will be provided

· Alternate III – If contractor represents that restricted computer software will be provided

· FSA Clause 52.227-16 – Additional Data Requirements if all data delivery requirements have not been identified.

· FSA Clause 52.227-17 Rights in Data – Special Works if the Government needs to restrict the contractor from use and release of data such as privacy data.

· FSA Clause 52.227-21 – Technical Data Declaration, Revision, and Withholding of Payment – Systems in all major system contracts.

· FSA Clause 52.227-22 – Major System – Minimum Rights in all major system contracts.

· FSA Clause 52.227-23 – Rights to Proposal Data (Technical) if there may be technical data in the proposals for which the Government may require unlimited rights.

· FSA Clause 52.227-19 – Commercial Computer Software Licenses in all direct orders for commercial off-the-shelf (COTS) software.

· FSA local clause 27-2 Contractor Use of Government Commercial Software in all contracts.

Incident and Problem Management The contractor shall use the FSA data center services and the Department of Education Help Desk to report all incidents. “All incidents” includes those occurring inside the FSA data center environment, and those incidents occurring in contractor’s applications outside the FSA data center environment. Until service is restored, the contractor shall assist immediately in timely notification, within 30 minutes of the incident occurrence and within 24 hours of follow up issues, escalation and resolution of any incidents that impact application degradation or outages. The contractor shall collaboratively participate in identifying the root cause of incident. The contractor shall also, develop solutions that resolve the issues and implement and test any corrective actions. In matters relevant to FSA systems impacted by the contractor’s work effort, the Contractor shall provide FSA and the FSA data center support and input into root-cause analysis.

Disaster Recovery and Continuity of Services

If the system/application is hosted and operates separate from and external to the Next Generation Data Center (NGDC), the contractor shall ensure that externally hosted FSA operations may be fully recovered. The contractor shall do so by implementing (execute) its Disaster Recovery Plan every year and shall provide evidence that it conducted the following efforts:

· To enable Federal Student Aid to continue operating during and after a disaster, the contractor shall develop, create, test, and maintain a Disaster Recovery Plan and its attending processes and procedures.

· If FSA launches the Disaster Recovery plan, the plan’s procedures shall precisely describe each Disaster Recovery team-member’s duties, responsibilities, and actions.

· A Disaster Recovery Plan will manage incidents that impact any/all FSA business-critical processes and activities. Incidents could range from a single server’s or server room’s failure, to a major facility’s complete malfunction.

· The contractor shall participate in and support testing of end-to-end transaction processing. In all appropriate Disaster Recovery tests (or exercises), the contractor will include internal FSA units and appropriate external entities.

· The contractor shall participate in annual Disaster Recovery Plan reviews, and in Disaster Recovery awareness and training exercises. Systems staff and support contractors shall contribute to annual business impact analyses and shall annually update VDC Business processes and applications. When a major system change (update to servers etc.) necessitates additional analyses or testing, the contractor shall provide additional input into VDC Business processes and applications.

· The contractor shall also assume responsibility for, and/or the following Disaster Recovery actions:

· Escalation authority

· Team members’ notification and team members’ responsibility assignments

· Disaster Recovery Plan storage

· Compilation of all contact lists that include phone numbers and email addresses

· Application server mapping

· Recovery/Reconstitution Plan

· Documentation will comply with current NIST 800-34 and NIST 800-53 requirements.

(NOTE: The plan will yield full recovery of FSA’s current, day-to-day, operations’ infrastructure, network and databases. After any disaster, Federal Student Aid expects a 99.9% recovery to pre-disaster function status.)

Please also refer to the applicable FSA local clauses as determined applicable by the Contracting Officer and included elsewhere in the contract: FSA 37-2 Continuation of Mission Critical Contractor Services and FSA 37-2 Continuation of Mission Critical Contractor Services – Alternative 1.

Information Technology Resources Retirement When an Information Resource reaches the end of its life cycle, and access to the resource by all users has been terminated, data resident on the resources shall be protected and transferred to the Government in a usable form within [fill in, e.g. prior to final payment, or after 120 days after resource retirement, whichever comes first] so it is available for future use, and other assets shall be disposed of in accordance with NIST publication 800-88.

Transition Support – This requirement is meet in other sections of the solicitation.

Surveillance and Oversight Governance & Review Boards Compliance and Support Requirements The contractor shall coordinate changes to the technology baseline in conjunction with the Department’s investment management, enterprise architecture, enterprise change management, release management, and standards governance processes.

https://studentaid.ed.gov/sa/about/contracting-info/it-standards

Audits & Reviews Language The contractor shall provide information and assistance to support periodic project and system specific auditing activities that Federal Student Aid conducts such as IV&V, QA, and LMM compliance and audits. The contractor shall maintain traceability of configuration items, including baselines and builds, to support all the functions of the Lifecycle Management Methodology, Change Management and Configuration Management processes.

On a periodic basis but no less frequently than annually, the Government will conduct quality assurance reviews to reduce the likelihood of risk causes and establish a basis of confidence that the contractor meets the quality and performance requirements of the contract. Government Contractor quality assurance at the source encompasses one or more of the following based on defined risk:

· Process Reviews: Reviews to determine the suitability, adequacy, and effectiveness of the process to achieve product outputs that meet contract requirements.

· System Assessments/Audits: Systematic, independent assessments and audits of the various elements of the contractual quality management system impacting process or product quality.

· Management and program reviews and meetings: Maintains open channels of communication.

Contractor shall comply with these reviews by providing the Government access to its physical facilities, its quality management system and other relevant documentation as well as allowing for onsite meetings/interviews with its key technical and management personnel as needed. Government reserves the right to add other quality assurance surveillance methods as required on routine, periodic, and/or random basis at no additional cost.

External Studies or Investigations Notwithstanding other terms of this contract, the Contractor shall accommodate the Department in providing information related to contract performance; respond to requests for information and data calls; and respond to inquiries from other Federal entities, all of which have been transmitted through the contracting officer. These federal entities may include but are not limited to: Congress; Comptroller General; Office of Management and Budget; Office of the Inspector General; and General Accounting Office (GAO). Such requests may also take the form of a Departmental program or Technology Office inspection, validation, or audit. The contractor shall furnish the requested information within the time constraints of the request.

Management

Lifecycle Management Methodology (LMM) Oversight and Governance The contractor shall comply with FSA’s Lifecycle Management Methodology (LMM) which defines the lifecycle activities, stage gates, and the minimum set of documentation to successfully oversee the development and/or, operations, and maintenance of federal information systems managed by FSA. The activities, documentation, and stage gates within the LMM have specific guidance describing how each item applies during the course of the system lifecycle and how to tailor or adjust each specific item, therefore will only use the minimum set up documentation as needed and when required to utilize the minimum set of system documentation as described in Section 4 of the Lifecycle Management Methodology (LMM).

The contractor shall comply with the FSA’s governance model (which is the FSA Lifecycle Management Methodology, abbreviated as LMM) which defines the control level activities, including all management and technical stage gates, and a minimum set of documentation requirements to successfully oversee a program or project, or the development and implementation, operating support, and disposal of a solution. FSA’s LMM is flexible and accommodates any development methodology.

Documentation created by the contractor as part of this Contract shall comply with the templates contained within FSA’s Lifecycle Management Methodology. The contractor shall deliver specific deliverables in a format prescribed by the FSA LMM templates.

If the contractor proposes use of their own methodology, the contractor shall provide a Lifecycle Management Methodology (LMM) Compliance Matrix that details how their processes and deliverables/work products trace to the Lifecycle Management Methodology Stages, Core Deliverables and Stage Gate Entry/Exit Criteria.

The contractor shall deliver LMM documentation and deliverables in a format prescribed by the FSA LMM templates and exemplars. Depending upon the specific needs of each task order or contract modification however, the FSA program office and contractor, in conjunction with guidance from the LMM SME, may agree to modify these templates on a mod by mod basis. If the contractor proposes use of their own template or a different deliverable format, the contractor shall provide a matrix that details how the content in their deliverable maps to the content required by the LMM template(s).

Refer to the Lifecycle Management Methodology section of the Federal Student Aid Technology Office IT Standards Library for additional information.

https://studentaid.ed.gov/about/contracting-info/it-standards https://studentaid.ed.gov/sa/sites/default/files/fsawg/static/gw/docs/ciolibrary/LMM_Process_Guide.pdf

Vendor Collaboration

Collaboration Requirement on Testing & Change Management The contractor shall collaborate with FSA’s Test Manager, the other contractors, and other project team members as needed to facilitate the success of activities.

The contractor shall collaborate with all service providers who use the change management tool and who are required to use change management and configuration management processes and all data center Information Technology Infrastructure Library (ITIL) Service Support and Service Delivery processes.

Collaboration with All Other Participants in Performance of Contract Requirements to FSA The contractor shall collaborate with FSA Technology Directorate Services, Business Units, and Other Contractor support staff in the holistic delivery of required services and results to FSA.

Performance Management and Reporting Requirements The contractor shall provide Federal Student Aid with complete copies of any System Development Lifecycle, Software Development Lifecycle, Software Engineering Handbook, Standard Operating Procedures, Corporate Policies, Quality Assurance (QA) Plans, Quality Control (QC) Plans, and similar guidance documents that relate to their solution development processes, as determined by the CO.

In addition, the contractor shall provide QA and QC records upon request by Federal Student Aid.

Requirements Management The contractor shall comply with standards for requirements management within the Lifecycle Management Methodology. Refer to the Lifecycle Management Methodology section of the Federal Student Aid Technology Office IT Standards Library for additional information.

https://studentaid.ed.gov/about/contracting-info/it-standards

Requirements and Configuration Management Traceability The Contractor shall ensure that all FSA Enterprise Configuration and Change Management transactions that involve the system(s) are supported, processed, and managed efficiently.

https://studentaid.ed.gov/about/contracting-info/it-standards https://fsa.share.ed.gov/lmm/

Release Management The contractor shall follow the Federal Student Aid Enterprise Change Management (ECM) processes to ensure all changes are coordinated, reviewed, and approved through Federal Student Aid organizational areas. As part of this process, the contractor shall collaborate with Federal Student Aid and Service Management processes, where applicable.

The contractor shall participate, in system or production readiness reviews prior to release of any production changes, and in testing of any changes that touch a system the contractor supports, or that is within the contractor’s area of responsibility. The contractor shall perform changes or maintenance of existing systems, release or implementation of new systems, and decommissioning or termination of systems where applicable.

Systems Development, Operations, and Maintenance The Contractor shall adhere to the approved Lifecycle Management Methodology tailoring plan for systems development, maintenance and operations of all systems including those developed to facilitate the processing and…