Amendment 3_FSA RFI Responses_Round Two_090525.pdf

FSA Technology Modernization Initiative RFI Response - Round 2 9/5/2025

1 | P a g e

# Question FSA Response

1 What is FSA’s current leaning on a canonical, government-owned data model and event-driven integration to reduce batch dependencies among FPS, COD, NSLDS, and EDMAPS/EDWA?

FSA is actively exploring a canonical, government-owned data model to standardize data semantics across systems. Event-driven integration is a key architectural goal to reduce latency and batch dependencies, particularly across FPS, COD, NSLDS, and EDMAPS/EDWA. This approach aligns with our modernization objectives to improve data consistency, enable real-time updates, and support scalable interoperability.

That said, one of the most significant challenges to this approach is the presence of legacy systems that were not originally designed for real-time or event-driven architectures. These systems often rely on batch processing and rigid data schemas, which can hinder seamless integration and limit responsiveness. FSA is particularly interested in industry feedback on how best to incrementally enable event-driven capabilities in this environment — including strategies for bridging legacy systems, sequencing modernization efforts, and managing coexistence with batch-based workflows during any potential transition.

2 Is a persistent person/party identifier and formal MDM capability in scope across

PAS/AIMS, COD, NSLDS,

DMCS, and Partner Connect?

FSA currently operates the pMDM system, which provides federated person master data management capabilities across several core platforms. This system supports identity resolution and stewardship functions that are foundational to ensuring consistency across borrower and partner records.

Expanding the reach of pMDM to include other systems, entities, or attributes is within scope and aligns with FSA’s broader goals around data quality, interoperability, and fraud prevention. At the same time, FSA is open to feedback on how best to evolve this capability — whether through targeted improvements, architectural enhancements, or potential replacement.

2 | P a g e

3 What SLAs are envisioned for near-real-time interoperability with USDS/servicers, so borrowers and schools see consistent information on StudentAid.gov?

We recommend framing SLAs for interoperability around timely, accurate, and consistent borrower- and school-facing information, rather than static system metrics. Industry can bring best-in-class recommendations from financial services and large-scale government systems to set thresholds that balance performance, resilience, and cost.

At a high level, targets might include:

Data propagation: Near real-time for critical borrower status changes; hours (not days) for less time-sensitive updates.

Availability: High availability of interoperability APIs (≥ 99.9%) with graceful degradation and retries.

Data quality: Consistent alignment between servicer/USDS systems and StudentAid.gov, with rapid detection and resolution of discrepancies.

These should be treated as evolving outcome-based measures, refined collaboratively with FSA and industry partners to ensure borrowers and schools always see a consistent and trustworthy view.

4 Would you prefer domain-based phased cutovers with a defined coexistence window, or another migration progression aligned to the Data Migration Roadmap and PRR gates?

FSA prefers a domain-based phased cutover strategy with a clearly defined coexistence window. This approach allows for more practical sequencing, clearer accountability, and reduced risk during transition. It also enables teams to tailor migration timelines and readiness criteria to the unique technical and operational characteristics of each domain.

While alignment with enterprise-level planning milestones such as PRR gates remains important, we are particularly interested in vendor input on how to manage coexistence windows, data synchronization, and rollback strategies to ensure continuity and minimize disruption during phased transitions.

5 Should respondents assume FedRAMP Moderate or High given PII and IRS FTI, and any constraints beyond the

Any cloud-based solutions must be FedRAMP authorized at Moderate level.

3 | P a g e onshore personnel expectations in the Q&A?

6 Do you have target thresholds (availability, data propagation time, duplicate reduction) you’d like us to design toward?

We do not have defined targets at this stage; instead, we envision collaboratively establishing thresholds with industry partners to ensure we achieve best-in-class availability, data timeliness, and data quality that meet borrower, partner, and mission needs.

7 Is this a Microsoft based system?

No.

8 Would it be possible to share the list of Data Security Products you have at Dept of Education? I captured the data security capabilities embedded in AWS Bedrock and Forcepoint, but are there other tools in place?

As part of its ongoing modernization and cybersecurity enhancement efforts, the Federal Student Aid (FSA) office is actively standardizing its cybersecurity toolsets to ensure consistent, scalable, and compliant security operations across its enterprise environments.

FSA currently employs a suite of Software-as-a-Service (SaaS) solutions to address specific cybersecurity functions, including but not limited to:

-Security Information and Event Management (SIEM): Splunk (SaaS) -Continuous Diagnostics and Mitigation (CDM): Tenable ONE (SaaS) -Case Management: ServiceNow (SaaS) -Security in DevOps Pipelines: AquaSec (SaaS) -Endpoint Detection and Response (EDR): Multiple tools are in use across legacy data centers, including Tanium, Trellix, SentinelOne, Microsoft Defender for Endpoint, CrowdStrike, and Symantec.

-Digital Forensics: EnCase -Network Packet Capture: FireEye PX, CloudLens, and IXIA Taps -Data Loss Prevention (DLP): Multiple tools are deployed, including ForcePoint, with extensive use of pattern-based detection such as Regular Expressions (RegEx).

FSA continues to pursue tool consolidation, integration, and automation, with a preference for native cloud service provider tools—particularly AWS-native solutions—when their capabilities are functionally comparable to those available in the broader marketplace.

4 | P a g e

9 Will FSA be providing a list of industry day participants by firm/name to those who registered This is universally useful for small and large firms for collaboration and teaming.

No, an interested parties list was not collected for this RFI.

10 Which core legacy systems present the greatest operational or compliance risks today (e.g., technical debt, maintenance costs, regulatory compliance)?

Our Data Analytics Platform currently poses the greatest operational risk—not only due to its underlying technology stack, but also because of the governance challenges surrounding data management. These include issues related to data quality, ownership, and access controls.

11 What are the key success criteria for evaluating a modernization effort — cost reduction, time-to-value, user adoption, or regulatory compliance?

Time-to-value is a primary success criterion, as it reflects how quickly the modernization effort delivers tangible benefits. Equally important is the ability to reduce or stabilize long-term costs, ensuring the solution remains sustainable and efficient over time.

12 What are the biggest barriers preventing seamless data exchange across student, borrower, and partner-facing systems?

FSA’s current technology environment is characterized by legacy systems that were developed for specific programs or functions. These systems often rely on batch-oriented data transfers, which delay updates and make it difficult to maintain a consistent, real-time view of a student or borrower across platforms. Interfaces between systems—such as FAFSA processing, loan origination, and servicing require extensive transformation and coordination, which slows delivery timelines and increases operational overhead.

In addition, the presence of multiple vendor-managed platforms with differing data structures, APIs, and security controls introduces complexity and risk. Coordinating changes across these systems requires significant effort and can lead to inconsistencies or delays.

5 | P a g e

13 Do you currently have a centralized data lake/data fabric strategy, or are integrations mostly point-to-point and manual?

FSA is in the process of transitioning from a predominant point-to-point integration model toward a more modern, centralized data architecture. While some legacy systems still rely on manual or batch-based data exchanges, efforts—such as the deployment of Enterprise Data Management and Analytics Platform Services (EDMAPS)—have laid the groundwork for more scalable and automated data flows. One major component of EDMAPS is a data lake; however, its usage and integration across the broader ecosystem can be improved upon to better support real-time data sharing and reduce duplication.

FSA is interested in vendor perspectives on how best to evolve this architecture. We welcome input on the design and implementation of centralized data lake or data fabric strategies that can support real-time interoperability, reduce data latency, and improve resilience across the student aid ecosystem—particularly in environments where legacy systems and decentralized data ownership remain constraints.

14 How important is real-time data integration (for analytics, eligibility checks, fraud prevention) compared to batch or scheduled updates?

Much of today’s student aid processing still relies on batch or scheduled data updates, and in many cases, this approach works well, especially when business processes are designed around predictable cycles.

Batch processing supports many of FSA’s core operations today.

Real-time or near-real-time data integration offers important advantages in areas where speed and accuracy are critical—such as fraud detection and analytics. It enables faster decision-making, reduces the risk of data mismatches, and supports more responsive oversight, all of which are areas FSA would like modernization to improve.

15 What are the pain points with managing multiple vendor solutions (licensing, integration, security, operational overhead)?

Managing multiple vendor solutions introduces several pain points that impact efficiency, cost, and security.

From a licensing perspective, differing contractual terms, renewal cycles, and pricing models create complexity and reduce economies of scale. Integration across heterogeneous platforms often requires custom interfaces, manual reconciliation, or workarounds that drive up cost and extend delivery timelines.

Security risks increase as each vendor solution brings its own access controls, patching cycles, and monitoring requirements, making it more difficult to maintain a consistent enterprise security posture.

Operationally, coordinating service-level agreements, issue resolution, and governance across vendors adds overhead and can dilute accountability.

6 | P a g e

16 Which functions do you consider most critical to consolidate first — ticketing/service management, monitoring, automation, security, or analytics?

From an operational standpoint, monitoring and analytics are the most critical functions to consolidate first.

They provide the foundational visibility needed to understand and manage the full operational landscape across FSA. Once that visibility is in place, consolidating ticketing/service management and automation can drive efficiency and responsiveness. Security improvements should naturally emerge across all these functions if consolidation is executed effectively.

17 What are the top frustrations students and borrowers face today when interacting with FSA services?

Students typically apply for financial aid through FAFSA.gov (StudentAid.gov) and manage their loans through separate loan servicer websites. This reliance on multiple platforms creates a fragmented experience that adds complexity not only for FSA, but also for students, parents, borrowers, and institutional partners.

Communication from FSA and loan servicers is another major point of pain, especially around deadlines or eligibility requirements. While the FAFSA process has undergone recent simplification efforts, it still poses challenges for students and parents. Additionally, many FSA programs—such as Public Service Loan Forgiveness (PSLF) and Income-Driven Repayment (IDR) plans—are inherently complex.

18 How do you measure customer experience success — faster response times, case resolution rates, proactive updates, or overall satisfaction scores

(CSAT/NPS)?

Federal Student Aid measures customer experience success using a combination of quantitative and qualitative metrics, aligned with broader federal customer experience (CX) standards. These include, but are not limited to, satisfaction scores, application processing times, application completion times, issue resolution scores, number of complaints, volume of calls, number of site errors, delinquency and default rates, and email conversion rates. We also track quality metrics, including application processing quality, contact center interaction quality, and issue resolution rate.

19 Which areas of your infrastructure are most prone to outages or performance bottlenecks (databases, application servers, cloud services)?

No single area of the infrastructure is disproportionately prone to failure; however, due to the high degree of system interdependence, an outage in one component (e.g., databases, application servers, or cloud services) can propagate and result in downstream impacts to end-user systems. We view this as an opportunity to work with industry on architectures that reduce cascading failures, improve fault isolation, and strengthen overall resiliency.

7 | P a g e

20 Do you have an established observability strategy (AIOps, predictive monitoring, anomaly detection), or is monitoring still siloed across tools?

Monitoring today remains somewhat siloed across tools, and we are actively defining a unified observability strategy with common standards and practices. Our goal is to work with industry to incorporate best-in-class capabilities such as AIOps, predictive monitoring, and anomaly detection to improve reliability and user experience.

21 How important is achieving high availability and resilience (e.g., disaster recovery, self-healing automation) versus simply improving uptime metrics?

High availability and resilience are equally important to traditional uptime metrics. Simply being “up” is not sufficient if performance or responsiveness degrades the end-user experience. Our focus is on end-to-end resilience, including disaster recovery, self-healing automation, and proactive performance management— so that systems are not only available but also reliable, responsive, and trusted by users.

22 What types of analytics and dashboards are most valuable to leadership — financial aid disbursement trends, student repayment risks, fraud detection, or service performance?

FSA leadership requires analytics and dashboards that provide both strategic insight and operational visibility across the full student aid lifecycle. High-value areas include financial aid disbursement trends to track funding flows and policy impacts; student repayment risk indicators to identify at-risk borrowers and guide proactive interventions; fraud detection and anomaly monitoring to protect program integrity; and service performance dashboards to monitor uptime, transaction volumes, and customer experience across digital and call center channels. These tools should deliver timely, actionable insights that enable leadership to make data-driven policy and operational decisions.

23 How accessible is your data to business stakeholders today, and do they rely on IT teams for reporting?

Business stakeholders at FSA have access to a broad range of data through EDMAPS; and many teams can develop and publish Tableau dashboards with little to no contractor support. This has enabled more self-service reporting and reduced reliance on IT for many day-to-day needs. However, not all of FSA’s operational systems send data into EDMAPS, and even when they do, the data feeds often include only a subset of the available fields. This limits the completeness and utility of the data for certain use cases, especially those requiring detailed operational context.

Additionally, because EDMAPS operates in GovCloud, some of the latest features and tools offered by commercial software vendors are not yet available, which can constrain innovation and user experience.

Addressing these limitations (i.e., both in terms of data coverage and platform capabilities) will be essential to fully realizing a modern, self-service data environment.

8 | P a g e

24 Would FSA benefit more from predictive analytics (e.g., loan default forecasting, risk scoring) or from real-time operational analytics (e.g., system health, SLA tracking)?

FSA sees value in both predictive analytics and real-time operational analytics, as each address different but complementary needs. Predictive capabilities such as loan default forecasting or borrower behavior modeling can inform proactive interventions, improve portfolio management, and strengthen policy decisions. Real-time operational analytics such as system health monitoring, SLA compliance tracking, and workload performance are equally critical for ensuring reliability, stability, and a consistent customer experience, especially during peak demand periods (e.g., FAFSA peak season). Rather than prioritizing one over the other, FSA envisions a complementary analytics approach that integrates predictive insights with real-time monitoring to create a holistic view of performance, risk, and outcomes.

25 What are the biggest security compliance challenges FSA faces — FedRAMP High, FISMA, Zero Trust maturity, or identity/access control?

FSA’s most significant security compliance challenge is not any single framework in isolation, but rather the interdependencies among them, particularly as they relate to achieving and sustaining a secure, scalable cloud environment under the FSA Technology Modernization Initiative.

While FedRAMP High is not currently mandated—as clarified in the July 2025 RFI, which states that “all systems will be required to be FedRAMP Moderate”—the agency continues to put a strong emphasis on elements of Zero Trust architecture, identity and access management (IAM), and FISMA compliance.

In summary, FSA’s biggest challenge lies in orchestrating the dependencies among IAM, Zero Trust, and FISMA to support its FedRAMP Moderate obligations today—and to prepare for potential FedRAMP High requirements in the future.

26 How do you currently manage vulnerability remediation and patching across IT/OT systems — is it centralized, automated, or manual?

FSA manages vulnerability remediation and patching through a centrally governed but operationally distributed process. Vulnerability detection is automated, with scans scheduled regularly and results analyzed by the Cyber Risk / Vulnerability Management Team. However, patching and remediation are not fully automated. Instead, they follow a multi-step process that includes validation of fixes in non-production environments, stakeholder review, and formal promotion to production systems. This approach ensures that remediation actions are deliberate, risk-informed, and aligned with FSA’s compliance and operational standards. While automation supports detection and reporting, execution of remediation is case-by-case, guided by SOPs and coordinated through ISSOs, system owners, and cybersecurity consultants as needed.

27 Paragraph Section 4.2.5 – Hosting, page 8, In the initial Q&A responses, FSA cited current prime contractors (i.e.

Accenture, GDIT, Peraton, Digital Customer Care (DCC) and Partner Participation Oversight (PPO) Platform and Services, and GSS Cloud Accenture 91003119F0003

Title IV Origination and Disbursement (TIVOD) System & Customer Service Transition Services Accenture 91003125C0013

9 | P a g e

Maximus...) that have current contracts for FSA which may be in the modernization efforts.

Can FSA provide contract numbers for these prime contractor efforts?

TIVOD Services Accenture EDFSA15C0006

Health Education Assistance Loan Program (HEAL) Online Processing System (HOPS) Arete Consulting

LLC 47QTCB22D0172

Unified Servicing and Data Solution CENTRAL RESEARCH INC 91003123D0002

Unified Servicing and Data Solution EdFinancial Services, LLC 91003123F0319

Perkins Loan Servicing Bridge Educational Computer Systems, Inc. (ECSI) 91003125C0020

AEDS II GDIT 91003119C0007

AEDS III GDIT 91003125C0016

Award Eligibility Determination (AED) system GDIT 91003122C0003

Consolidation Origination and Adjustments (COA) Maximus 91003124F0302

Next Gen BPO Processing Support Services Solution (PSSS) Maximus 91003121F0347

Next Gen Business Process Operations (BPO) Maximus 91003120D0005

Unified Servicing and Data Solution - Maximus Education Aidvantage Maximus 91003123D0001

USDS O&M Maximus 91003124F0317

Unified Servicing and Data Solution Missouri Higher Education Loan Authority (MOHELA) 91003123D0004

Unified Servicing and Data Solution Nelnet Servicing, LLC 91003123D0005

Next Generation Data Center (NGDC) Peraton EDFSA15O0090

10 | P a g e

28 Paragraph Section 4.2.5 – Hosting, page 8, For current hosted applications, what are the total FSA costs of hosting and egress fess over the last 12 and 24 months?

FY2024 “hosting costs” ranged between $118M-$124M

29 Can the ownership of the FSA Cloud (managed by Accenture) be transferred to FSA or a future contractor? For example, is there any contractual constraint on root account transfers and master payer accounts to new owners for AWS accounts?

Yes, FSA retains the right to transfer ownership of the FSA Cloud environment—currently managed by Accenture—to either FSA itself or a future contractor. This includes the ability to transfer control of AWS root accounts and master payer accounts, provided the transition is executed in accordance with federal security and governance protocols.

30 Please provide a detailed description about the telecommunications linkages between the various cloud enclaves supporting the FSA application portfolio (i.e., NGDC, FSA Cloud, FTI Infrastructure). Please also include those linkages between those cloud enclaves and “external” enclaves (i.e., COD, DMCS, and loan servicers).

Telecommunication linkage between the various enclaves supporting the FSA portfolio is currently done using a MPLS network or MTIPS connections. FSA is currently planning the implementation of a new Transit Gateway that would cross connect the NGDC/FTII enclaves to the FSA Cloud/COD enclaves. Once the Transit Gateway is implemented, traffic from the MTIPS connections used by those specific enclaves would be migrated to private AWS network routes using the Transit Gateway.

11 | P a g e

31 The modernized ecosystem should improve data flow between application processing, grant/loan origination, servicing, and analytics systems. FSA seeks to efficiently integrate new and existing data assets to support real-time data sharing and minimize batch file transfers that cause latency or downtime."

What is the size of the real time data needing to be ingested/analyzed per day? 10gb? 100gb? 1tb?

The volume of real-time data to be ingested and analyzed will ultimately depend on the final system design and which processes are brought into scope. At this stage, a precise estimate isn’t available. Accurately sizing the requirement would likely involve reviewing existing batch and streaming jobs across systems to understand current data movement patterns and volumes.

That said, given the scale of FSA’s operations, it’s reasonable to expect that real-time data volumes could be significant—potentially ranging from tens to hundreds of gigabytes per day, or more. The actual volume will vary based on factors like data granularity, event frequency, and how broadly real-time integration is implemented.

32 NSLDS (the legacy version) was introduced in the 1990s and has grown to accumulate data on over 100 million student aid recipients and over 52 terabytes of data."

What percent of this FSA data is just for long term storage? And what percent of the data needs millisecond search response times?

The vast majority of NSLDS data—estimated at 85–90% —is likely archival or historical in nature, used primarily for compliance, audit, and reporting purposes. This data can be stored in cost-efficient, long-term storage tiers with infrequent access patterns.

A smaller subset—most likely 10–15%—may require low-latency, millisecond-level access, particularly for operational systems that support:

• Real-time eligibility checks

• Loan servicing updates

• Identity verification

• Fraud detection

• Student and institutional portal queries These workloads demand high-performance storage and indexing strategies, especially as FSA modernizes its architecture to support more responsive, user-centric services.

12 | P a g e

33 What kind of query times are you looking to achieve on your real time data analysis / queries?

Today, most basic analytics queries against the loan portfolio—such as those run in EDMAPS against tables with hundreds of millions of records—complete in under three minutes. That performance is generally sufficient for many operational and oversight needs.

For real-time or near-real-time data analysis, the goal would be to maintain or improve on that baseline where appropriate. Specific query time targets will depend on the use case, data architecture, and tooling.

Some scenarios may require sub-minute or interactive response times, while others may tolerate longer durations.

34 How long do you need to be able to search the real time data?

Data retention, access and utilization all depend on type of data, purpose or use and functionality needs of individual systems.