Q_A_for_NASIS_0001.pdf

Q&A FOR NASIS SOLICITATION 140A2325Q0066

1. How many schools will be serviced for this contract? 186 schools Is there an estimate of how many students will need to be covered? ~44000 total. ~13000 BOS, ~31000 TCS

2. How many licenses will be required? There is no per seat licensing, but NASIS 2 is delivered as an enterprise license.

3. Can we get clarification on the resume expectations? Highlight candidates understanding of implementing a large-scale Student Information System. The PWS includes resume guidelines, but they do not appear in the formatting instructions in the solicitation. Are resumes expected at this time?

Yes If so, what are the formatting guidelines for those resumes? 2 pages per resume, education, work experience and highlighting candidates experience implementing a large-scale SIS.

4. Is this solicitation set aside for Native American Indian businesses? Yes, as found on pages 1 and 22 of this solicitation it identifies 1452.280-1 Notice of Indian Small Business Economic Enterprise Set-

Aside (ISBEE).

5. What organization is the current incumbent? Infinite Campus What is the award dollar amount?

Original award at $7,588,873.88; Bridge award at $1,385,200.00.

6. Will this opportunity require direct contact with Indian Children? Possible

7. How extensive should the background check be? BIE will conduct personnel background checks, which are considered full background checks CIPA compliant background investigations Should this include drug testing? Possible

8. On average, how many help desk tickets are opened each month? On average, 1,400 per month.

9. On average, how long does it take to complete a help desk ticket? On average, 1 to 10 days.

10. What is the current service level agreement to respond to a help desk ticket request? For example, emergency requests within the hour? Non-emergency requests within 4 hours? A majority of the cases are medium priority. Response time to critical support cases are generally within 2 hours.

11. How long will the incumbent be available during the transitionary period? 6-9 months

12. Will the incumbent be able to answer questions and provide access to existing data sets for an initial load into our solution? The new contractor will work with the incumbent to accomplish this task.

13. We know the current system is proprietary in nature. Will we be able to get a demo of the current system functionality? The new contractor will work with the incumbent to accomplish this task.

14. On average, how many concurrent users are logged into the system? 200+

15. On average, what is the number of participants in each training session? Virtual 10 participants. In-person 80 participants.

16. What is the training schedule like? Monthly virtual sessions shall be available. For example, would there be scheduled monthly or quarterly “sessions”? Or is training requested on demand? Three in-person regional training sessions are expected.

17. How often will new student data need to be loaded? Student data is entered on a daily basis. Is this monthly, quarterly, etc. Student data is enrollment and demographic data. Student assessment data is uploaded on an annual basis.

18. Are the reports requested mostly aggregated data? The reports contain both aggregated and de-identified data. Or are they a mix of de-identified data sets? Options are available on how a report is generated. Reports are to meet federal reporting requirements that are listed in the PWS.

19. Should users of our system be able to download reports to their workstations? Yes If so, should we allow for excel, .pdf, .csv, or word document downloads? Excel/pdf

20. How often will new reports and/or system functionality be requested? Not often and only if a change scope bilateral modification is executed by CO. For complex requests, will we be able to quote such changes outside the scope of the software license? Only if a change scope bilateral modification is executed by CO.

21. Which states does that district need to report data to? The BIE has implemented a unified assessment for all BIE schools; however, the law allows tribes to request to waive the BIE’s assessments, accountability, or both (assessments and accountability). If there are multiple, which states and what are the submissions are you responsible for? Arizona, California, Florida, Iowa, Idaho, Kansas, Louisiana, Maine, Michigan, Minnesota, Missouri, Montana, North Carolina, North Dakota, New

Mexico, Nevada, Oklahoma, Oregon, South Dakota, Utah, Washington, Wisconsin, and Wyoming.

22. You mentioned the need to enhance functionality, improve reporting, facilitate data cleanup, and offer robust 24/7 support. Are there any additional high-level objectives or success criteria that we should be aware of (e.g., compliance, user experience improvements, stakeholder satisfaction)? No, the PWS requirements are the standard for this project.

23. Beyond resolving the cons identified in Infinite Campus (e.g., cultural relevance, demographic reporting, communication tools), is there a vision for new functionalities you would like to implement?

No, the PWS requirements is the standard for this project.

24. Among the various requirements outlined in the PWS, which are the top three priorities for the Bureau of Indian Education (BIE) in this contract? All of the requirements outlined in the PWS have the same level of priority.

25. We understand you need an Authority to Operate (ATO) within 12 months. Are there any other major deadlines linked to federal reporting cycles, new school years, or legislative changes? Not at this time, however new information will be shared asap.

26. Beyond meeting compliance requirements and achieving the mandated uptime, are there additional key performance indicators (KPIs) or success metrics (e.g., user satisfaction rates, reduced data errors, improved reporting times)? Uptime and access SLAs are included in the PWS. Offeror may propose others.

27. Do you prefer a phased implementation (e.g., rolling out specific features or modules in stages) or a single, consolidated go-live date? The government is open to offeror’s implementation approach.

28. Are there any specific deadlines tied to school calendar events or federal reporting cycles that must guide our timeline? DoEd EdFacts Reporting Requirements and Timeline

29. Do any of the 186 schools or 15 regional ERCs require special features (e.g., specialized tribal or state-level data fields) beyond what’s described? No

30. Will the BIE provide any existing documentation, system architecture details, or APIs for vendors to better understand the current NASIS setup? As indicated in the PWS, OneRoster 2.1, or equivalent is desired for interoperability. OAuth2.x for secure data in transit to meet A-130 DIT encryption requirements. Transparent Data Encryption (TDE) on the backend database to meet A-130 Data AT

Rest (DAR) encryption.

Data Cleanup and Migration

31. What is the scope of the data cleanup required (e.g., merging duplicates, normalizing fields, addressing incomplete historical records)? Data clean up is ongoing. This requirement is in accordance with the Federal regulations on Records Management 44 U.S.C. § 3301, which is covered by the Privacy Act of 1974, 5 U.S.C 552a.

32. Can you provide approximate data sizes (e.g., total GB/TB, historical student records) or specific historical data complexities that might affect the migration timeline? Large, since this projects requirement includes 186 schools and is estimated to be 44,000 students.

33. Are there specific data governance or quality standards (especially around sensitive student data) we should be aware of for compliance (e.g., FERPA, local tribal regulations)? FERPA, CIPA.

34. Are there any additional federal or tribal security regulations (FISMA, Section 508) that the system must meet or maintain? See PWS for Security related requirements

35. Are there preferred cloud security frameworks or controls that must be in place (e.g., FedRAMP, ISO

27001)? Will the government require direct administrative access to the hosting environment? The

PWS specifies Contractor-Owned, Contractor-Operated. FIPS-140-3, NIST SP 800-53 Rev 5.1, NIST

SP 800-37 Rev 2 Moderate Impact with Privacy Overlays.

36. Are there any specific DOI or IA-OIMT security policies beyond NIST SP 800-53 that must be followed? Yes, DOI has several IT Security policies. Which will be provided to the incumbent contractor once the NDA is signed after the contract kick off meeting.

37. What specific encryption standards (e.g., FIPS 140-2/3) are required for data at rest, in transit, and during backup operations? Currently TLS 1.2 with upcoming migration to TLS 1.3.

38. What is the expected response time and process for addressing security incidents? Within one hour from suspected data breach to notification of the IA CIRT, DOI CIRC or DHS.

39. How frequently will the system undergo security audits, vulnerability scans, and penetration testing?

Will these be conducted internally by BIE/DOI, or is the contractor expected to provide third-party assessments? The system will undergo a yearly security assessment based upon the Trigger

Assessments in the NIST SP 800-37 Rev 2. Monthly vulnerability scans and reporting is required.

Application penetration testing will be yearly requirement.

40. Will the BIE provide security training for contractor personnel, or is the contractor expected to develop and conduct annual security awareness training? The DOI Talent training platform does provide IT Security awareness and privacy training. Recommend the incumbent contractor develop IT security-based training to support their specific needs.

41. You noted the need to capture students’ tribal affiliations, language programs, community-based learning, and cultural interventions. Could you share any existing data standards or code sets used for tribal identification or cultural participation? Information will be shared to the incumbent after kick-off meeting.

42. How do you envision measuring the impact of culturally responsive teaching (e.g., custom reports, dashboards, progress tracking)? All of the tools in the SIS will be used to measure data relevancy.

Some tools are expected to be more detailed than others.

43. Are there any additional tribal, linguistic, or culturally specific data elements not explicitly listed that would require custom tracking, e.g., local dialect fields, extended family guardian definitions, or specialized forms? No, only what’s identified in the PWS.

44. Do you envision new analytics or dashboards specifically tracking cultural engagement, attendance in cultural programs, or community-based learning outcomes not covered by standard forms? No

45. The current system does not support alternative assessment models (e.g., oral traditions, experiential learning). Could you clarify how you would like these to be represented in the SIS (e.g., custom rubrics, narrative assessments, multimedia submissions)? That is not a requirement.

46. You mentioned that while IEPs exist for special education, there are no tools for culturally specific interventions or tribal education programs. Are there specific data elements or workflows needed to create and track these new types of individualized plans? No

47. Does the BIE require support for multiple Native languages in the system interface, reporting, or communication tools? No, it does not. If so, which languages should be prioritized? N/A

48. How should the SIS accommodate tribal-specific educational requirements, languages, and cultural programs? It does not. Are there specific tribes with unique data reporting needs? No there are not.

49. Which specific reports or data sets are critical for compliance (e.g., BIE, BIA, Title I, ISEP data)? All of the reports listed in the PWS and PRS.

50. Do you need real-time or near-real-time reporting, or are these predominantly periodic (e.g., quarterly, annual) submissions? As identified in the PWS and PRS, there will be occasional real-time/near-real-time reporting.

51. Are there any additional reporting requirements from federal, state, or tribal entities that may not be explicitly mentioned in the PWS? No there is not.

52. You mentioned limited racial and ethnic identification options in the current system. Are there established guidelines for collecting and reporting tribal affiliations, multiple tribes, or urban/reservation-based distinctions? No there is not.

53. Will the enhanced system be required to generate custom demographic reports for funding or resource allocation purposes? As identified in the PWS/PRS, reporting requirements are the purpose for funding and resource allocation.

54. Beyond compliance, do you require analytics functionality (e.g., predictive analytics for student performance, attendance tracking, data visualization)? As stated in the PWS, these analytics are part of the current SIS and will remaining part of the system.

55. Are there specialized ad hoc reporting needs (e.g., tribal grants, specific state waivers) that go beyond the enumerated forms? No there is not. If so, how frequently are these requested? N/A

56. What types of reports or dashboards would be most beneficial for tribal education departments to monitor student progress and program effectiveness? The same as the BIE operated schools.

57. How can the SIS better support Native communities and parents in tracking student progress while respecting cultural values and data privacy concerns? By staying compliant with all of the outlined federal security requirements in the PWS.

58. How many years of historical data must be maintained, and what are the expectations for archiving or purging data over time? The inception of NASIS has been since 2006-2007. Therefore, there are many years of student data. As far as archiving and purging data, we will need to adhere to federal records management regulations and policy.

59. We understand that the schedule of trainings must be provided virtually and in-person. Would any schools or Education Resource Center (ERC) require onsite (in-person) sessions for staff with limited internet connectivity or technology experience? Yes If so, how many sessions and in which regions?

Expectation is one a year for each region.

60. Are there specific language or cultural needs for training materials (e.g., translations, culturally adapted examples)? No there is not.

Change Management & User Adoption

61. How do you plan to introduce system changes across geographically dispersed schools? Online or regional trainings.

62. Have you identified local champions or tribal liaisons who can support adoption and address cultural considerations? Yes

63. We understand that the BIE has an eLMS platform. Is there an expectation that we will use the current eLMS for hosting user manuals and help guides? Yes

64. What level of detail do you expect in system documentation and standard operating procedures?

65. What are your expectations for response and resolution times for different types of issues? See attachment 2 – performance requirements summary for expectations as well as weekly reporting meetings.

66. Are there opportunities to improve current processes related to submitting support requests, tracking status of requests, and resolution of requests? Yes, if the contractor can identify improved processes, the Government is open to discussions.

67. Does BIE have specific penalties for not meeting the 99.97% availability target, or is that purely a performance metric with milestone-based evaluations? Yes, if the contractor does not meet said target, the Government will work with the contractor on a Corrective Act Plan (CAP), if said target goes unresolved the Government will follow the CAPs procedure before termination is considered.

68. Do you anticipate frequent system enhancements or prefer scheduled updates (e.g., quarterly, annually)? No enhancements, only scheduled updates whether quarterly or annually.

69. Will you provide any internal IT resources to assist with maintenance, or do you prefer a fully outsourced support model? Fully outsourced supported model.

70. As the system usage grows or new schools join, do you foresee additional hardware or licensing requirements? Not at this time.

71. Are you open to expansions or custom modules beyond the initial scope (e.g., after-year-one enhancements)? No only what is required in the PWS.

72. Who will be the primary decision-makers, points of contact, and subject matter experts on your side?

This information will be shared after the award is made and at the kick-off meeting.

73. Will there be a dedicated Tribal liaison or cultural consultant to guide the inclusion of culturally relevant features? No

74. What is your governance model for scope changes and approvals throughout the project? Only through the Contracting Officer.

75. How often do you require status updates or stakeholder meetings? See attachment 2 – performance requirement summary.

76. We anticipate needing software developers, system architects, a product manager, and a customer service desk. Are you open to a blend of on-site and remote staffing? Whatever best fits the requirements for 24/7 coverage.

77. Do you have preferences for project management methodology (Agile, Waterfall, or hybrid)? No

78. The PWS demands specific SIS background. Beyond SIS experience, do you prefer additional certifications (e.g., PMP, Agile Scrum Master, or cybersecurity credentials) for key roles? Additional certifications that are relevant to requirements can be included.

79. Are you anticipating a Time and Materials (T&M) contract with hourly billing, or do you prefer a fixed-price or milestone-based approach? As the solicitation states in Section B, part 1 Contract Type a “single Firm Fixed Priced type contract”.

80. Do you have a not-to-exceed budget range, or will funding be allocated in phases? BIE has a budget for this project, total amount is privileged information.

81. How is ongoing funding structured—annual appropriations, multi-year budgeting, or another method?

Annual appropriations

82. Do you foresee an indefinite delivery/indefinite quantity (IDIQ) format or a base-year-plus-option-years model? As the solicitation states on page 4 Section B, part 2 Period of Performance “Base plus

4 option years”.

83. Are you requesting detailed line-item costs (staffing, hardware, software licensing, training, support) in the RFP response? Use Attachment 4 – Pricing Schedule, we are not requesting for additional information except for what is outlined in the pricing schedule, however additional information will not be rejected.

84. Do you anticipate changes in scope after initial discovery sessions or pilot phases? If change is required.

85. What are your primary concerns about transitioning from Infinite Campus to a new or significantly upgraded SIS? Loss of functionality, Lowered edge security controls,

86. Do you have contingency plans if data cleanup or system migration is more complex than expected?

Will work with the incumbent if this requirements is more complex than expected.

87. Are there any additional acceptance tests or pilot phases the BIE wants to see that are not explicitly spelled out (e.g., partial go-live at a pilot school before system-wide rollout)? User Acceptance

Testing by the NASIS Team and 3 to 5 end users from 3 TCS and 3 BOS schools

88. Is the Government concerned about any specific risk beyond the typical (e.g., reluctance from some schools to adopt new SIS)? Data breach by an APT.

89. Within the Implementation and Test Plan (I&TP), will there be formal user acceptance testing (UAT) milestones for each module (e.g., data migration, new cultural tracking features, reporting)? Yes, UAT will be required before going live.

90. Are there specific performance metrics or key performance indicators (KPIs) you will use to evaluate success? UAT testing will require the development of Use Cases.