04 - Deliverable Chart.pdf

Deliverable Chart – Attachment 04

Deliverable Name

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria

1 Transition Management Plan

1.5.3 Transition Support

Includes all aspects of how the organization will shift from a legacy system to a new system. This plan covers the responsibilities associated with maintenance and support to a new contractor from the development contractor. The Department will want mock-ups and prototypes to review and approve.

Within 1-month of contract award.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner

Contracting Officer’s Representative concurs information is accurate and complete.

2 Data Quality Control Plan

1.5.12 Data

Planning and Managemen t

Plan to ensure the quality and accuracy of data for reporting, reconciliations, and servicing.

Within the proposal. Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner

Contracting Officer’s Representative concurs

3 Records Inventory

EDAR

Clause 3452.204-70

– Records Managemen t

Records inventory showing compliance with all Federal records created for U.S.

Government use, created during performance of the contract, and/or delivered to, or under the legal control of the U.S Government in accordance with Federal Law.

Within 60-days of award

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner

Contracting Officer’s Representative concurs

4 Federal Record Series/System Outside of Records Inventory Report

EDAR

Clause 3452.204-70

– Records Managemen t

Notification if Contractor creates, receives, or maintains a Federal record series or system that is not included in the records inventory and provide the

Within 5 business days of the Contractor’s creation, receipt, or maintenance of such Federal record series or system

Email to FSA.ACQ.LoanServicin g@ed.gov; CO; CS;

COR; and Business Owner

The Department will review the records inventory for accuracy and accept or reject the records inventory within 60 business days after receipt.

The Department will periodically review, and may, in mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria

Contracting Officer with a revised records inventory.

its sole discretion, update, the records inventory to ensure that it is current, accurate, and

5 Attestation of Records Management Laws and Regulations

EDAR

Clause 3452.204-70

– Records

Attestation to compliance with all applicable management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including the Federal Records Act (44 U.S.C. chapters 21, 29, 31, and 33), NARA regulations at 36 CFR chapter XX, subchapter B, including 36 CFR Part 1236, and those policies associated with safeguarding of Federal Records covered by the Privacy Act of 1974 as amended (Privacy Act)(5 U.S.C. 552a).

Annually (5th business day of January)

Email to FSA.ACQ.LoanServicin g@ed.gov; CO; CS;

Delivered timely

6 Training Completion Reports

Various Training in Clauses

Completion according to Department policies, including initial training and any annual or refresher training

Within 60-days of training delivery

Email to FSA.ACQ.LoanServicin g@ed.gov; CO; CS;

7 Report on Unlawful or Accidental Removal, Defacing, Alteration, Destruction of Federal Records

EDAR

Clause 3452.204-70

– Records

Under no circumstances shall the Contractor destroy Federal records except in accordance with the provisions of this contract and the Federal Records Act. See approved records inventory

Within 1 Business Day of Event

Email to FSA.ACQ.LoanServicin g@ed.gov; CO; CS;

COR; and Business mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria for proper federal record disposition.

8 Annual Report Summary

1.4 Table 4

Performanc e Requiremen ts

Each year, the Servicer shall send a file that includes all reports from July 1 through June 30 for retention purposes.

Annually Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner

Delivered timely and do not require final acceptance.

9 Various Reports 1.4 Table 4 Performanc e Requiremen ts

Reports, as detailed in the PWS (e.g., assignment volume, accounting, reconciliation, delinquency, client level reports).

As specified (weekly, monthly, quarterly, annually)

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Delivered timely and do not require final acceptance.

10 Correspondence 1.4 Table 4 Row 2 Performanc e Requiremen ts

Correspondence, needs to follow the borrower’s preference (electronic or physical correspondence, stored on the borrower portal, and is including but not limited to:

• Welcome letter: Informs borrowers that their loans have been transferred to the current Servicer’s loan servicing center.

• Account status

• Borrower request

• Delinquency condition

• Documentation received

(e.g., request for deferment or forbearance)

• Change in loan terms.

Correspondence to institutions related to assignment of loans to include but not be limited to

As specified (daily, weekly, monthly, quarterly, annually)

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Contract Officer Representative and Business Owner sign off on final correspondence.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria acceptance reports and detailed rejection reports

11 DEAL

Reconciliation

Attachment

BO180

3-way “Transfer-In” reconciliation (also known as a DEAL reconciliation) for every loan transfer file received by the contractor

Monthly Email to FSA.ACQ.LoanServicin g@ed.gov; CO; CS;

Delivered timely and complete

12 System Balancing Report

Attachment

BO22

Report showing evidence of monthly system balancing with all interfacing systems by Loan Program of all activity sent to and received from others systems (including manual sources). The report shall include all data fields and information as shown on the attached sample report.

Monthly Email to FSA.ACQ.LoanServicin g@ed.gov; CO; CS;

Delivered timely and complete

13 Monthly Cash Receipts Detail Report

Attachment

BO28

Report documenting monthly total for deposits on the "Monthly Cash Receipts Detail Report" reconciles with cash reported on the contractors monthly trial balance reporting

Monthly Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

14 Monthly Disbursement Detail Report

Attachment

BO29

Monthly Disbursement Detail Report

Monthly Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

15 Contractor Monthly and

FYTD

Transaction Posting Report

Attachment

BO33

Report of transactions posted to borrower accounts on their servicing system by servicing system transaction codes for the current month and also for the fiscal year to date.

Monthly Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria

16 Borrower History Report

1.2 Report shall include all

historical servicing information about the borrower and borrower’s loans within the BHAR (for the time period for the loan/borrower was on the contractor’s system) in a standardized machine-readable format to be issued by FSA

On transfer Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

Delivered timely and free of errors

17 Transfer Tracking Log

1.2 Tracking log shall contain all

loan transfers

Weekly on Fridays Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

18 Post Transfer Activity Report

Attachment

BO182

The report shall include the number of borrowers within each transfer (as a count and % of all borrowers in transfer) that have logged onto their servicing web account, those that have set preferences via the web (or via other methods), and a count of how many have made payments since being transferred. The report shall include a view of the status of the borrowers in comparison to status at time of transfer. The contractor shall maintain the detailed, borrower level information to support the summary information provided in the

Every month (on the 10th business day) for 12 months after the transfer has been completed.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria report and provide the detailed data on demand.

19 Change Request Status Report

FSA 43-1

Change Request Modification s

Weekly Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

20 Personnel Roster and Monthly PIV Card Report

5.4.10.1, 5.4.10.5

ICAM

Reporting Requiremen ts

Monthly report listing all personnel assigned to the contract, status of background investigation for each person, and network access / PIV reporting required under the ICAM Reporting Requirements section.

Within 5 business days of Contract Award Date Updated within one business day of personnel being assigned to the contract or removed from the contract;

and monthly.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner

This report must fulfill all requirements listed under the ICAM Reporting Requirements section. Please use the Monthly Vendor Employee Template (Attachment 09).

21 Transition / Phase-Out Plan

5.4.3 Transition Support

Plan on how the Contractor’s will transition out services to FSA or another Contractor.

Six Months after Contract Award Date

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and

22 Property Management Plan [Optional deliverable – if there will be gov furnished property/laptops, also need to include requirement from situational requirements document]

1.3 Specific

Requiremen ts; FSA 45-1 Special Contract Requiremen ts for Government Furnished Property – Two Factor Authenticati on Tokens

(TEA)

Documents the approach for managing government property under the contract.

Includes assignment of personnel responsible for property management and processes/procedures that will be followed.

Within 5 business days of receipt of Government Furnished Property

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner

Information is accurate and complete.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria

23 Project Status Report

1.4.17 Project, Risk, and Schedule Managemen t and Reporting

This is a report that provides the Government with the status of ongoing efforts under the scope of the contract.

Weekly Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

24 Technology Business Management (TBM) Data Report

1.5.16 Technology Business Managemen t (TBM) Data Reporting

Completed TBM Data Report Template.

Percentage of total cost of the investment into the required appropriate TBM IT Towers and IT Cost Pools Report formats.

August 15 annually and whenever the contractor determines that the percentages must be changed.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Report is accurate, complete, and reported in the required most current FSA template.

25 Program/Project Management Plan

1.5.17 Project, Risk, and Schedule Managemen t and Reporting

The full set of documents required to manage the program or project. The documents explain how the program or project will be controlled, executed, and monitored.

Areas to be covered include:

Scope Management, Schedule Management, Resource Management, Quality Management, Performance Management, and Risk Management.

These artifacts may be individual documents or combined.

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Plans include all components and are kept up to date. Plan change logs are maintained, and plans are followed.

26 Vendor Risk Management Plan

1.5.17 Project, Risk, and Schedule Managemen

Separate from the Integrated Project Management Plan that includes Risk Management; a Vendor Risk Management Plan describing

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Plans include all components and are kept up to date. Plan change logs are maintained, and plans are followed.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria t and Reporting the vendor’s internal processes and procedures for managing their own risks.

27 Program/Project Schedule

1.5.17.

Project, Risk, and Schedule Managemen t and Reporting

A program/project schedule is a listing of a project's milestones, activities, and deliverables, with planned start and finish dates.

Schedule includes a work breakdown structure (WBS) and associated staff/personnel resources responsible for each work package.

WBS is decomposed to a work package/task duration targeted to 40 hours per task or as otherwise agreed to in writing by FSA.

Initial work breakdown structure delivered within 10 business days after contract award.

Full baselined schedule delivered within 30 days of contract award. The schedule baseline must be jointly agreed by the FSA Project Manager, FSA COR, FSA

Contract Officer and the contractor.

Schedule is updated weekly.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Follows the Ten Best Practices in U.S. Government Accountability Office (GAO) Schedule Assessment Guide

(SAG)

https://www.gao.gov/assets/68 0/674404.pdf)

28 Risk Log 1.5.17.

Project, Risk, and Schedule Managemen t and Reporting

The risk log or risk register tracks all identified risks, triggers, and risk response plans. The risks should be reviewed on a regular basis and updated as needed.

Initial risk log within 10 days of contract award and updated weekly.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Risk logs are kept up to date.

Critical and high negative risks have risk responses that include mitigation.

29 Action and Issue Log

1.5.17.

Project, Risk, and Schedule Managemen t and Reporting

The Action and Issue Log tracks action items, issues (risks when the trigger date is within 30 days of occurring), status, and resolution.

Initial action and issue log within 10 days of contract award and updated weekly.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Logs are kept up to date with actions taken, next action planned, and status.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov https://www.gao.gov/assets/680/674404.pdf https://www.gao.gov/assets/680/674404.pdf mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria

30 Categorization Worksheet (and associated entries in

CSAM)

1.5.10.11 Cybersecurit y Requiremen ts

The Categorization Worksheet is used to assess the security and sensitivity of a system. It is used to classify a system as either a general support system (GSS) or a major application (MA), identify data sensitivities, and to ensure that the system has the appropriate level of security.

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Worksheet is fully filled out and information is complete and accurate.

31 Privacy Threshold Analysis (PTA)

1.5.10.11 Cybersecurit y Requiremen ts

The Privacy Threshold Analysis is used to determine whether a Privacy Impact Analysis is necessary. The PTA determines all subsequent privacy requirements.

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

The Contractor shall provide information required to complete and finalize the PTA (e.g., populating form fields, providing explanations or clarifications, etc.).

32 Privacy Impact Assessment

(PIA)

1.5.10.11 Cybersecurit y Requiremen ts

The Privacy Impact Assessment is used to identify if a system contains privacy information and lets the public know what information is collected and how it is secured, used, and shared. Information collected may include Social Security Numbers, PINs, Addresses, Dates of Birth, etc. The PTA (above) determines whether a PIA is required. PIAs often require multiple levels of approvals/signatures (including ED OM Privacy) and should be completed as soon as possible due to the

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

The Contractor shall provide information required to complete and finalize the PIA (e.g., populating form fields, providing explanations or clarifications, etc.).

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria length of time required for necessary approvals. A system cannot go live until the PIA is reported to the Office of Management and Budget and posted to the OM Privacy website.

33 System of Records Notice

(SORN)

1.5.10.11 Cybersecurit y Requiremen ts

Describes the Privacy Act system of records, and the categories of PII collected, maintained, retrieved, and used within the system. It provides information to the public on various characteristics of the system (e.g., description, purpose, data collection, notification, retention and disposal, etc.)

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Contractor shall provide information required to complete and finalize the SORN (e.g., populating form fields, providing explanations or clarifications, etc.).

34 External Data Exchange Documents

1.5.10.11 Cybersecurit y Requiremen ts

Sufficient information must be provided to complete any required Memorandum of Understanding (MOU), Computer Matching Agreement (CMA), and/or Interconnection Security Agreement (ISA)

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

The contractor shall provide information required to complete and finalize and complete external data exchange documents with interfacing systems and agencies.

22 Business Impact Analysis (BIA)

1.5.10.11 Cybersecurit y Requiremen ts

This is an application-level document that reveals any vulnerabilities, and a planning component to develop strategies for minimizing risks. Often part of the disaster recovery plan, it is likely to identify costs linked to failures, such as loss of cash flow, replacement of equipment, salaries paid to

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

The Contractor shall provide information required for FSA to complete and finalize the BIA.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria catch up with a backlog of work, and loss of profits.

35 IT Contingency Plan (includes Test Plan)

1.5.10.11 Cybersecurit y Requiremen ts

Documents the critical business functions that need to be resumed and in what order, what technical components are affected in the case of a disaster, and the key individuals who should be familiar with their duties under the plan.

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

36 IT Contingency Test Results

1.5.10.11 Cybersecurit y Requiremen ts

Contingency Test Results are not at the application level.

Contingency Test Results are only required if not already covered by an existing enterprise level Contingency Plan Test Results document.

Typically, these results are obtained through annual disaster recovery testing.

When requested by

FSA.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

37 Disaster Recovery Plan

1.5.10.11 Cybersecurit y Requiremen ts

This is a standard operating procedure that describes how the organization is to deal with potential disasters by explaining the precautions taken so that the effects of a disaster will be minimized, and the organization will be able to either maintain or quickly resume mission-critical functions. Disaster Recovery Exercise reports, quality management findings, and human capital results at the enterprise level.

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria

38 System Authorization Boundary

1.5.10.11 Cybersecurit y Requiremen ts

Defines system boundaries for and relationships between systems and communication channels.

When requested by

FSA.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

39 Configuration Management Plan

1.5.1 FSA

System Developmen t Lifecycle And 1.5.10.11 Cybersecurit y Requiremen ts

The Configuration Management (CM) Plan provides an overview of the organization, activities, overall tasks, and objectives of CM for an initiative. It addresses baseline work products, describes the mechanism to track and control changes/change requests, and the mechanism to establish and maintain baseline integrity.

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

40 System Security Plan

1.5.10.11 Cybersecurit y Requiremen ts

Provides an overview of the security requirements of the system and describes the controls in place or planned responsibilities and expected behavior of all individuals who access the system. This document is maintained by the contractor in the CSAM tool.

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

The SSP shall include but is not limited to the following Standard Operating Procedures (SOPs):

• Access Control Policies and Procedures

• Audit and Accountability Policy and Procedures

• Configuration Management Policy

• Identification and Authentication Policy

• System Maintenance Procedures

• Media Protection Policy

• Physical and Environmental Policy

• Security Planning Policy

• Personnel Security Policy mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria

• Risk Assessment Policy

• System and Services Acquisition Policy

• System and Communications Protection Policy

• System and Information Integrity Policy

• Data Quality Integrity Policy

41 Incident Response Plan

(IRP)

1.5.10.11 Cybersecurit y Requiremen ts

System-level Incident Handling Plan, including system/incident-level contacts and all required incident response steps.

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Includes Breach Notification Policy and Response Plan as part of the document.

42 Technical Description

1.5.10.11 Cybersecurit y Requiremen ts

Technical description of the information system.

Maintained in CSAM and updated at least quarterly.

Maintained in CSAM Information is accurate and complete. Fully addresses information requested by the template.

43 System Description

1.5.10.11 Cybersecurit y Requiremen ts

Functional and business description of the information system.

Maintained in CSAM and updated at least quarterly.

Maintained in CSAM Information is accurate and complete. Fully addresses information requested by the template.

44 Hardware Listing

1.5.10.11 Cybersecurit y Requiremen ts

Listing of hardware utilized by the information system.

Maintained in CSAM and updated at least quarterly.

Maintained in CSAM Information is accurate and complete. Fully addresses information requested by the template.

45 Software Listing 1.5.10.11 Cybersecurit y Requiremen ts

Listing of software utilized by the information system.

Maintained in CSAM and updated at least quarterly.

Maintained in CSAM Information is accurate and complete. Fully addresses information requested by the template.

46 Plans of Actions and Milestones (POA&Ms)

1.5.10.11 Cybersecurit y

Plan to remediate security vulnerabilities and documentation weaknesses.

Occur on an as-needed basis.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

Information is accurate and complete. Fully addresses information requested by the template.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria

Requiremen ts

COR; and Business Owner as applicable

Each POA&M is approved by the ISSO and IV&V Team.

Submissions and responses must meet timelines identified in ED and FSA procedures for POA&Ms.

47 Cyber Scope Report

1.5.10.11 Cybersecurit y Requiremen ts

CyberScope is a web-based application that collects data from each federal agency, to assess IT security. FISMA reporting through CyberScope involves direct data feeds from security management tools, direct reporting from continuous monitoring programs, and security management tools which is required by OMB.

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

48 Requirements Management Plan

1.5.1 FSA

System Developmen t Lifecycle

The Requirements Management Plan defines the processes and procedures to be used by the project team to manage and track the functional and non-functional requirements of the system.

This Plan defines how requirements will be elicited, structured and prioritized;

how requirements will be recorded; how requirements will be modified; and how requirements will be traced and reconciled for final delivery of the product. The plan also specifies roles and responsibilities.

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria

49 High Level Requirements

1.5.1 FSA

System Developmen t Lifecycle

This document includes high-level functional and non-functional requirements in a format suitable for the project at hand. The document must address the breadth of coverage and provide at least a preliminary description of how requirements may be grouped into releases and iterations.

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

50 Detailed Requirements

1.5.1 FSA

System Developmen t Lifecycle

The Detailed Requirements Document includes detailed functional and non-functional requirements in the form of declarative statements, uses cases and other requirement artifact types as applicable to the project. Requirements in this document are captured at the level from which they can inform design and development.

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

51 Requirements Traceability Matrix

1.5.1 FSA

System Developmen t Lifecycle

The Requirements Traceability Matrix (RTM) ensures bi-directional traceability between high level/business and detailed/system requirements. The RTM also associates detailed/system requirements with portions of the build designed to satisfy them. Testing is also tied to the requirements on which they are based to ensure that

Within 30 days of Contract Award Date and updated at least annually.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria the build meets all requirements.

52 Data Migration Plan

1.5.1 FSA

System Developmen t Lifecycle And

1.5.12 Data

Planning and

Document defines the processes associated with completion of the data migration effort, which includes conversion strategies, data mapping (which are the detailed requirements), data clean up, and testing.

When requested by

FSA.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

53 Data Management Documentation

1.5.1 FSA

System Developmen t Lifecycle And

1.5.12 Data

Planning and Managemen t

See Data Planning and Management/Data Management Section

When requested by

FSA.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

54 Detailed Design Document

1.5.1 FSA

System Developmen t Lifecycle

The Detailed Design Document provides a detailed design, using several different architectural views (to include use case diagrams) to depict different aspects of the system. It is intended to capture and convey the detail necessary to allow coders to develop the system, and to support critical design reviews before beginning development.

Within 30 days of Contract Award Date and updated at least annually

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria

55 Source Code 1.5.1 FSA System Developmen t Lifecycle And 1.5.5 Intellectual Property

Source code for software developed under the scope of this contract. This includes custom developed software, source code for the custom components of mixed custom-COTS solutions, custom components of mixed custom-SaaS solutions, scripts, batch files, application program interfaces (APIs), and any other software component that is written in support of the contract.

Components that are licensed from third-party commercial providers (COTS or SaaS products) will be administered through the software licensing process.

At end of contract period of performance and as requested by FSA.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

All components necessary for FSA to operate, maintain, and compile the system are turned over to FSA.

56 Solution User Manual

1.5.1 FSA

System Developmen t Lifecycle

The Solution User Manual describes in detail the user/system interaction facilities offered by the system, which allow the users to leverage the system functionality in support of their business processes. This deliverable is written to an audience of system end users.

When requested by

FSA.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

57 Release Version Description Document

1.5.1 FSA

System Developmen t Lifecycle

The Release Version Description Document is used to track, and control versions of software and hardware being released to implementation, testing, or

Within 30 days of any version release.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria the final operational environment. For COTS products, this typically takes the form a “release notes” from a software vendor.

58 Master Test Plan 1.5.1 FSA System Developmen t Lifecycle

Provides a central artifact to govern the planning, control, and test management of the test effort. It defines the general approach that will be employed to test the solution and to evaluate the results of that testing and is the top-level plan that will be used by managers to govern and direct detailed testing activities.

When requested by

FSA.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

59 Phase Level Test Plan – System Testing

1.5.1 FSA

System Developmen t Lifecycle

Documents the approach for the system test phase.

When requested by

FSA.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

60 Phase Level Test Plan – User Acceptance Testing

1.5.1 FSA

System Developmen t Lifecycle

Documents the approach for the User Acceptance Test phase.

When requested by

FSA.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

61 Phase Level Test Plan – Other Test Phases (Accessibility, Hardware Testing, Connectivity Testing, etc)

1.5.1 FSA

System Developmen t Lifecycle

Documents the approach to a specific phase of testing for a system release (System Test, Intersystem Test, Performance Test, User Acceptance Test, etc.).

When requested by

FSA.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria

62 Test Suites 1.5.1 FSA System Developmen t Lifecycle

Test Suites outline a set of several test scenarios, test cases and test scripts for a component or system under test.

When requested by

FSA.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

63 Test Readiness Review – System Test

1.5.1 FSA

System Developmen t Lifecycle

The Test Readiness Review artifacts provide management with an assessment of the readiness of the development maturity, test environment, test data, test processes, deliverables and other dependencies to ensure the system is ready to pass from build/construct to formal system testing and that known risks have been documented, accepted or mitigated.

When requested by

FSA.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

64 Test Readiness Review – User Acceptance Test

1.5.1 FSA

System Developmen t Lifecycle

The Test Readiness Review artifacts provide management with an assessment of the readiness of the development maturity, test environment, test data, test processes, deliverables and other dependencies to ensure the system is ready to pass from system testing to user acceptance testing and that known risks have been documented, accepted or mitigated. Typically, user acceptance testing is a resource intensive activity for FSA personnel and management should be

Within 30 days of system go-live

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria confident that the system is ready to move into the test phase.

65 Test Readiness Review – Other Test Phases

1.5.1 FSA

System Developmen t Lifecycle

The Test Readiness Review artifacts provide management with an assessment of the readiness of the development maturity, test environment, test data, test processes, deliverables, and other dependencies to ensure the system is ready to pass from build/construct to testing and that known risks have been documented, accepted or mitigated.

Within 30 days of system go-live

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

66 Defect Management Report

1.5.1 FSA

System Developmen t Lifecycle

The Defect Management Report details the defects discovered during testing.

Various reports are required for each phase of testing.

Within 30 days of system go-live

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

67 Test Summary Report

1.5.1 FSA

System Developmen t Lifecycle

This report gives a summarization of the system test phase of the project. The report includes support materials pertaining to the software version, deviations from those areas that were agreed to in the System Test Plan, gives an overall assessment of the product that was tested, and provides an overall status of the incidents found during the system test activity.

Within 30 days of system go-live

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

68 User Acceptance Test

1.5.1 FSA

System

The User Acceptance Test Summary Report gives a

Within 30 days of system go-live

Email to FSA.ACQ.LoanServic

Information is accurate and complete.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria

Summary Report

Developmen t Lifecycle summarization of the user acceptance test phase of the project. The report includes support materials pertaining to the software version, deviations from those areas that were agreed to in the User Acceptance Test Plan, gives an overall assessment of the product that was tested and gives an overall status of the incidents found during the user acceptance test.

ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

69 Implementation Plan

1.5.1 FSA

System Developmen t Lifecycle

This document describes the planned procedures for releasing a new system or system module to production.

It lists deployment goals;

critical success factors;

deployment tasks (including post implementation testing);

resources, and tools; task and resource dependencies;

task responsibilities and timelines for completion; and significant risks and contingency plans. A full implementation plan is appropriate for new system implementations; existing systems typically meet this requirement by producing an hour-by-hour plan of the implementation activities.

Within 30 days of system go-live

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

70 Training Plan 1.5.1 FSA System

The Training Plan documents the approach to knowledge transfer and the training to be

Within 30 days of system go-live

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

Information is accurate and complete.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria

Developmen t Lifecycle provided or arranged for end-users and support staff, including prerequisites, courses, course curricula, mode of delivery and attendees.

COR; and Business Owner as applicable

71 Operations and Maintenance (O&M) Plan

1.5.1 FSA

System Developmen t Lifecycle

This plan documents all ongoing activities necessary to operate and maintain the system in proper functioning condition. This plan includes a description of the resources required and their responsibilities, operational procedures for system startup and restart, backup and recovery, system archiving, and job scheduling. In addition, this plan addresses any training required by the user community in order to use the system and Service Level Agreement metrics associated with the system.

Within 30 days of system go-live

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

72 Capacity Planning and Management Reports

1.5.11 Capacity Planning and Managemen t

Capacity planning reports and recommendations; annual forecast and recommendations it proposes to adopt in fulfillment of the contract with specific sizes, quantities, specifications and timing

Baseline capacity report within 30 days of system go-live and reported on a quarterly cycle there-after.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Information is accurate and complete.

73 Production Readiness Review

1.5.1 FSA

System Developmen t Lifecycle

Production Readiness Review includes a review of test results, changes to the security posture of the system, and activities that

Pre-PRR (draft document) presentation due 20 days prior to go-live/implementation-

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

Provides the information required in FSA’s Production Readiness Review Template.

Information is complete and accurate.

mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria have been completed to prepare a system release for implementation. PRR is the final management decision point before a system release is implemented.

PRR meeting held approximately 14 days prior to go-live.

Final PRR presentation due 8 days prior to go-live.

Formal PRR meeting held approximately 5 days prior to go-live.

74 System Retirement and Disposal Plan

1.5.1 FSA

System Developmen t Lifecycle

The Retirement and Disposal Plan provides the necessary direction to properly sanitize, archive, dispose (decommission) and retire a specific information system.

Toward the end of the contract period of performance at the request of FSA.

Email to FSA.ACQ.LoanServic ing@ed.gov; CO; CS;

COR; and Business Owner as applicable

The plan follows National Institute of Standards and Technology (NIST), Department of Education and FSA guidelines, policies, standards, and procedures.

75 Records Disposition Attestation

EDAR

Clause 3452.204-70

– Records

Attestation of proper disposition of any Federal records including a statement that the Contractor has not retained or has any access to Federal records or copies thereof.

Within 30 business days of expiration of termination of contract

Email to FSA.ACQ.LoanServicin g@ed.gov; CO; CS;

Owner as applicable

76 Contract Requirements Validation Report

1.2 Report which validates that all

requirements of the contract are being met. The contractor shall provide the method by which each requirement can be validated and the processes/procedures to validate them to FSA on demand.

Annually and on demand as requested by FSA

Email to FSA.ACQ.LoanServicin g@ed.gov; CO; CS;

Owner as applicable

77 Legal Matter Notification

1.2 The contractor shall provide

FSA with the court documents related to lawsuits when they

Within 7 calendar days of receipt. For

Email to:

OversightspecialProje cts@ed.gov and

Delivered timely and free of errors mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:FSA.ACQ.LoanServicing@ed.gov mailto:OversightspecialProjects@ed.gov mailto:OversightspecialProjects@ed.gov mailto:OversightspecialProjects@ed.gov

PWS

Section

Reference Deliverable Description Due Date /

Frequency Deliver to

Acceptance Criteria are named a defendant in a lawsuit or when required to provide plaintiffs’ attorney(s) or other officials part of lawsuit borrower data or data related to ED held assets.

The contractor shall provide copies of any subpoena’s received in relation to the federally held portfolio or the federal servicing activities completed by the contractor any new legal proceedings.

Monthly for updates of ongoing and past legal proceedings related to consumer protection compliance issues.

Upon receipt of a Subpoena for information on an FSA Borrower, immediately.

FSA-

adcontrolmail@ed.go v

CO, CS, FSA OGC

mailto:FSA-adcontrolmail@ed.gov