2-RFI RFI-AW-27400 Assessment Platform Final.pdf

REQUEST FOR INFORMATION (RFI)

RFI-AW-27400

ASSESSMENT PLATFORM

This is NOT a Solicitation

IMPORTANT NOTICE

SUBMISSIONS WILL ONLY BE ACCEPTED ELECTRONICALLY VIA THE BONFIRE PORTAL

(https://pwcs.bonfirehub.com/portal)

Prince William County Public Schools (PWCS) uses a procurement portal powered by Bonfire for accepting and reviewing vendor submissions in response to RFIs. To register, visit https://pwcs.bonfirehub.com. Registration is free. Additional assistance is also available by emailing support@gobonfire.com or via the following link, https://pwcs.bonfirehub.com/portal/support.

Electronic submission via the Bonfire portal is mandatory for all RFIs issued by PWCS. Submissions sent by paper, telephone, facsimile (“FAX”), or email will not be accepted unless explicitly stated otherwise in the RFI document.

PWCS strongly encourages vendors to submit responses well in advance of the deadline. A submission is not considered complete until all required files have been uploaded and the ‘Submit & Finalize’ step has been completed. Vendors are responsible for ensuring timely and successful submission.

All questions pertaining to this RFI must be submitted through the Bonfire portal no later than 11:00 A.M. E.T., September 18, 2026. If you are unable to submit your questions via Bonfire, submit them to the PWCS Senior Buyer, Amie Wensel at wenselal@pwcs.edu and purchasing@pwcs.edu.

Responses to inquiries will be provided via Bonfire.

https://pwcs.bonfirehub.com/portal https://pwcs.bonfirehub.com/ mailto:support@gobonfire.com https://pwcs.bonfirehub.com/portal/support mailto:purchasing@pwcs.edu

ISSUE DATE: September 4, 2026 RFI #: RFI-AW-27400

TITLE: Assessment Platform

Responses must be received no later than 3:00 p.m. local prevailing time on October 2, 2026.

Responses received after the stated due date and time may not be considered.

Information the Respondents deem proprietary is to be included on the Proprietary Information Form, see Attachment A. This form shall be included in the vendor’s response to the RFI. See Submission of Proprietary Information Section 8.1 for additional information.

Proprietary Information Enclosed: YES_____NO

Name And Address of Firm:

_______________________________________ Date: _______________________________

_______________________________________ By: __________________________________ _______________________________________ Signature _______________________________________ Print/Type _______________________________________ Title

_______________________________________ E-Mail Address: _____________________

Telephone: __________________________

TABLE OF CONTENTS

TITLE Page NO.

DISCLAIMER

PURPOSE

BACKGROUND

ANTICIPATED STATEMENT OF NEEDS

SPECIFIC INFORMATION REQUESTED……………………………………………………………10

ESTIMATED NON-BINDING PRICING………………………………………………………….……12

SUBMITTAL INSTRUCTIONS ......................................................................... ………………...12

SUBMISSION OF INFORMATION TO RFI…………...………………………..………………….…13

ATTACHMENTS:

PROPRIETARY INFORMATION FORM…………………………………………….ATTACHMENT A

PWCS REQUIRED 1EDTECH CERTIFICATIONS………………………………..ATTACHMENT B

PWCS ASP REQUIREMENTS……………………………………………………...ATTACHMENT C

ASSESSMENT PLATFORM REQUIREMENTS RESPONSE MATRIX…….….ATTACHMENT D

1. DISCLAIMER: This RFI is issued solely for informational, market research, planning, and budgeting purposes. It is not a solicitation and will not result in a contract award. Responders are solely responsible for the expenses associated with responding to this RFI.

2. PURPOSE: Prince William County Public Schools (PWCS) is seeking information from qualified vendors regarding comprehensive assessment platform solutions capable of supporting division-wide assessment development, delivery, scoring, reporting, and analytics. The purpose of this RFI is to identify available solutions that align with PWCS instructional, assessment, accessibility, integration, and reporting requirements. Information obtained through this RFI may be used by PWCS for market research, planning, budgeting, and development of potential future requirements. Issuance of this RFI does not obligate PWCS to issue a subsequent solicitation or establish a timeline for any future procurement. PWCS welcomes complete or partial responses that provide useful information regarding available solutions and capabilities in the market.

3. BACKGROUND: Prince William County Public Schools (PWCS) is located approximately 35 miles southwest of Washington, D.C., and about 85 miles north of Richmond, Virginia. The county spans 348 square miles, stretching from the Potomac River to the Bull Run Mountains.

As of September 30, 2025, PWCS had an enrollment of 89,731 students from PK-12, making it the second-largest school division in the Commonwealth of Virginia. The school system currently operates 62 elementary schools, 17 middle schools, 13 high schools, three combined schools (two serving grades 1–8 and one serving Kindergarten–8), and three other educational institutions.

4. ANTICIPATED STATEMENT OF NEEDS: PWCS anticipates the need for a comprehensive, vendor-hosted assessment platform that supports the development, administration, scoring, analysis, and reporting of assessments across the school division. The solution should provide a secure, accessible, user-friendly environment that supports instructional and assessment practices while integrating with existing PWCS systems.

The requirements identified below represent PWCS's current anticipated functional and technical needs and are provided for market research, planning, and budgeting purposes. For purposes of this RFI, requirements identified as “Currently Required Capability” represent capabilities PWCS currently anticipates would be required of a future solution, while requirements identified as “Desired Capability” represent capabilities PWCS considers desirable but does not currently anticipate requiring in a future solution. These designations are for informational and planning purposes and do not constitute evaluation criteria for this RFI or obligate PWCS to include the requirement or designation in any future solicitation.

4.1. Accessibility and Inclusion

4.1.1. The platform must comply with applicable federal accessibility requirements, including Web Content Accessibility Guidelines

(WCAG) 2.1, Level AA. (Currently Required Capability)

4.1.2. The platform must provide language supports for English Learners.

(Currently Required Capability)

4.1.3. The platform must provide read-aloud functionality that can be selectively enabled or disabled by assessment or item type.

(Currently Required Capability)

4.1.4. The platform should provide translation capabilities. Human-generated or human-reviewed translations are preferred over fully AI-generated translations. Translation features should be capable of being disabled for specific assessments or items. (Desired Capability)

4.2. Assessment Delivery and Scoring

4.2.1. The platform should support scoring of paper-and-pencil assessments. (Desired Capability)

4.2.2. The platform must support partial-credit scoring for assessment items. (Currently Required Capability)

4.2.3. The platform should provide a secure testing environment or browser-lockdown capability to support academic integrity. (Desired Capability)

4.3. Assessment Design and Authoring

4.3.1. The platform must support a balanced assessment system, including formative and summative assessments, and diverse item types such as multiple-choice, short-answer, technology-enhanced, rubric-scored, and other applicable assessment formats. (Currently Required Capability)

4.3.2. The platform must have the capability to provide students with immediate scoring and feedback upon submission for automatically scored assessment items, where appropriate. Immediate scoring is not expected for assessment items requiring manual evaluation, such as writing, speaking, or other constructed-response items.

(Currently Required Capability)

4.3.3. The platform must support configuration consistent with applicable PWCS assessment and grading practices, including, as applicable, the ability to support retakes and provide prompt feedback to students. Additional information regarding PWCS assessment and grading practices is available on the PWCS Grading webpage.

https://www.pwcs.edu/about/departments/student_learning/grading/index

(Currently Required Capability)

4.3.4. The platform must support the inclusion of multimedia content within assessment items. (Currently Required Capability)

4.3.5. The platform should support the delivery of instructional resources and reteaching materials through assessment feedback. (Desired Capability)

4.3.6. The platform must allow students to submit multimedia responses.

(Currently Required Capability)

4.3.7. The platform must support special characters and symbols frequently used in mathematics and world language assessments.

(Currently Required Capability)

4.3.8. The platform must support integration with Desmos calculators used on Virginia Standards of Learning (SOL) assessments.

(Currently Required Capability)

4.3.9. The platform must allow assessment items and assessments to be aligned to multiple standards. (Currently Required Capability)

4.4. Content and Assessment Resources

4.4.1. The platform must support alignment of assessment items to the Virginia Standards of Learning (SOLs) at the standard, benchmark, and/or indicator level. (Currently Required Capability)

4.4.2. The platform must provide an automated process for realigning assessment items when applicable standards are updated.

(Currently Required Capability)

4.4.3. The platform should provide formative assessment templates.

(Desired Capability)

4.4.4. The platform should provide an item bank aligned to the Virginia Standards of Learning (SOLs). (Currently Required Capability)

4.4.5. The platform must support local development of assessment items across all supported item types and allow standards tagging.

(Currently Required Capability)

4.4.6. The platform should provide a formative assessment item bank.

(Currently Required Capability)

4.4.7. The platform must allow authorized central office staff to create and distribute assessments to schools and teachers. (Currently Required Capability)

4.5. Integration, Reporting, and Analytics

4.5.1. The platform must export or otherwise provide assessment data for integration with PWCS's Qlik analytics environment. (Currently Required Capability)

4.5.2. The platform should support automated integration with Qlik without requiring routine manual data processing by PWCS staff. (Desired Capability)

4.5.3. The platform should integrate with the Canvas Learning Management System. (Currently Required Capability)

4.5.4. The platform must integrate with the PWCS Student Information System (SIS). (Currently Required Capability)

4.5.5. The platform must support access through the PWCS ClassLink portal and single sign-on environment. (Currently Required Capability)

4.5.6. The platform must provide reporting capabilities at the division, school, classroom, and individual student levels. (Currently Required Capability)

4.5.7. The platform must support rubric-based scoring, including custom rubrics developed by PWCS. (Currently Required Capability)

4.5.8. Results dashboards must be configurable to PWCS-defined cut scores. (Currently Required Capability)

4.5.9. Results dashboards should support configurable performance levels based on course or assessment needs. (Desired Capability)

4.5.10. The platform should provide user adoption and system usage analytics. (Currently Required Capability)

4.6. User Roles and Permissions

4.6.1. The platform must provide a student preview or student-view capability. (Currently Required Capability)

4.6.2. The platform should provide a limited parent/guardian view option.

4.6.3. The platform must support configurable role-based permissions.

4.6.4. The platform must provide schoolwide administrative and instructional coaching views. (Currently Required Capability)

4.6.5. The platform must provide division-wide access and reporting views for authorized central office personnel. (Currently Required Capability)

4.7. Training, Usability, and Support

4.7.1. The vendor must collaborate with PWCS staff to design and deliver implementation, training, and professional learning resources.

(Currently Required Capability)

4.7.2. The platform must provide an intuitive, user-friendly interface designed to minimize end-user training requirements. (Currently Required Capability)

4.7.3. The platform must meet the essential criteria outlined in the ISTE Teacher Ready Evaluation Tool or equivalent educator usability standards. (Currently Required Capability)

4.7.4. The proposed solution must be capable of meeting applicable PWCS data security and privacy requirements. (Currently Required Capability)

4.8. Assessment Interoperability and Technical Capabilities

4.8.1. The platform must support the import, export, authoring, editing, and delivery of complete Question and Test Interoperability (QTI) assessment packages while preserving applicable assessment components. (Currently Required Capability)

4.8.2. The platform must preserve the hierarchical organization of assessments, including assessments, sections, test parts, item groups, passages, stimuli, sequencing, branching, navigation rules, adaptive behavior where applicable, timing constraints, and item ordering as defined within the QTI package. (Currently Required Capability)

4.8.3. The platform must support applicable QTI interactions, including technology-enhanced item types, scoring rules, response processing, feedback, variables, outcomes, templates, and associated assets without degradation or conversion to non-standard formats. (Currently Required Capability)

4.8.4. The platform must preserve applicable item-level and assessment-level metadata, identifiers, learning standards alignments, scoring information, version information where supported, and relationships among items, stimuli, and associated resources during import and export. (Currently Required Capability)

4.8.5. The platform must preserve accessibility information contained within QTI packages and associated standards, including alternative text, semantic markup, keyboard accessibility, assistive technology compatibility, accessible media, and accommodations, so that imported assessments remain accessible following import, editing, and delivery. (Currently Required Capability)

4.8.6. The platform must preserve media assets, mathematical notation, graphics, tables, audio, video, and other embedded assessment resources during import and export. (Currently Required Capability)

4.8.7. The platform must support round-trip assessment content exchange, including import, editing, export, and re-import, while maintaining functional equivalence and applicable standards compliance without introducing broken items, inaccessible content, or loss of assessment structure. (Currently Required Capability)

4.8.8. The platform must validate imported QTI packages and identify unsupported or non-conformant elements through validation information or reporting. (Currently Required Capability)

4.8.9. Respondents should identify each QTI version currently supported by the proposed platform and describe:

4.8.9.1. The level of implementation and any known limitations.

4.8.9.2. QTI elements or interaction types that are not fully supported.

4.8.9.3. How the platform validates conformance with applicable QTI specifications.

4.8.9.4. How technology-enhanced items remain functional

following import and export.

4.8.9.5. How accessibility information is preserved throughout the assessment lifecycle.

4.8.9.6. Interoperability experience with other QTI-compliant authoring, item-banking, and assessment-delivery systems.

4.8.9.7. Circumstances in which manual remediation may be

required following QTI import or export.

4.9. PWCS Technology, Interoperability, and Security Information

4.9.1. For informational purposes, Respondents may review Attachment B, PWCS Required 1EdTech Certifications, and Attachment C, PWCS ASP Requirements, to understand PWCS interoperability, certification, integration, security, and technology expectations.

Respondents are not required to complete or submit Attachments B or C as part of their RFI response.

4.9.2. PWCS is not requesting proof of certification, completed proof-of-integration activities, or other formal compliance documentation as part of this RFI response. Such documentation may be required as part of a future solicitation, if issued.

5. SPECIFIC INFORMATION REQUESTED: PWCS is seeking information regarding commercially available assessment platform solutions capable of addressing the anticipated needs and requirements identified in Section 4, Anticipated Statement of Needs.

Respondents shall complete Attachment D, Assessment Platform Requirements Response Matrix, to the extent applicable to the solution or capabilities addressed in their response. For the requirements identified in Part I, Respondents shall indicate the level of support provided by their proposed solution using one of the following response categories:

• Fully Supported – The requirement is currently available and fully supported as part of the Respondent's proposed solution.

• Partially Supported – The proposed solution currently supports some, but not all, aspects of the requirement.

• Not Supported – The proposed solution does not currently support the requirement.

• Planned/Future Enhancement – The requirement is not currently supported but is included in the Respondent's planned product development roadmap.

Respondents shall also provide the information requested in Part II of Attachment D to the extent applicable to their solution.

Respondents shall use the Comments/Explanation field in Attachment D to provide additional information where necessary for PWCS to understand the response. At a minimum, Respondents should identify any limitations, dependencies, required configurations or integrations, third-party products or services, planned enhancements and anticipated availability dates, or other material considerations associated with meeting a requirement.

Respondents shall also indicate in Attachment D whether satisfying a requirement would result in an additional cost beyond the proposed base platform or licensing structure. Where additional cost applies, Respondents should describe the applicable product, module, service, license, integration, or other cost component in the Comments/Explanation field and include the associated estimated cost in the response to Section 6, Estimated Non- Binding Pricing.

In addition to completing Attachment D, Respondents should provide the following information regarding their proposed solution:

5.1. Company Overview: Provide a brief overview of the company and its experience providing assessment platform solutions in K–12 educational environments.

5.2. Product and Platform Overview: Provide an overview of the proposed assessment platform, including its primary functionality, available modules or components, and the grade levels and user groups supported.

5.3. Deployment Model: Describe the recommended deployment and hosting model for the proposed solution and identify any significant technical or operational requirements for PWCS.

5.4. Integration and Interoperability Capabilities: Describe the solution's integration and interoperability capabilities relevant to the PWCS environment, including supported methods for system integration, data exchange, single sign-on, rostering, learning management systems, analytics platforms, and assessment content interoperability.

5.5. Security, Privacy, and Accessibility: Describe the solution's approach to data security, privacy, and accessibility, including any known limitations relevant to the anticipated PWCS requirements. Attachments B and C are provided for informational and planning purposes as described in Section 4 and are not required to be completed as part of the RFI response.

5.6. Implementation Approach and Timeline: Describe the recommended implementation approach and estimated timeline for division-wide implementation, including major implementation phases, configuration, integration, data migration where applicable, testing, and deployment.

5.7. Training and Professional Learning: Describe the training, onboarding, professional learning, documentation, and other resources available to support PWCS administrators, educators, and other applicable users during implementation and ongoing use of the platform.

5.8. Customer and Technical Support: Describe the customer and technical support model available to PWCS, including available support channels, hours of support, escalation processes, and applicable service levels.

5.9. Additional Information and Recommendations: Identify any additional functionality, emerging capabilities, implementation considerations, alternative approaches, or recommendations that the Respondent believes PWCS should consider when evaluating assessment platform solutions, including relevant capabilities or functionality not specifically identified in this RFI.

6. ESTIMATED NON-BINDING PRICING: PWCS is requesting pricing information to assist in understanding available pricing and licensing models and developing budgetary estimates for future planning. Respondents should provide an estimated, non-binding pricing structure for the proposed solution. Pricing provided in response to this RFI is for informational and planning purposes only and does not constitute a commitment by PWCS.

Respondents should identify, as applicable, the proposed licensing model and all anticipated cost components, including software/platform licensing, implementation and configuration, integrations, data migration, training and professional learning, technical support, maintenance, optional modules or functionality, third-party products or services, and any recurring or one-time fees. Respondents should clearly identify functionality described in their response that would require additional licensing or fees beyond the proposed base platform.

7. SUBMITTAL INSTRUCTIONS: PWCS is seeking information regarding your company's product(s), service(s), technique(s) and/or method(s). Interested vendors are encouraged to submit their response to this RFI as set out below. Responses are requested to be submitted via Bonfire no later than 3:00 p.m. local prevailing time on October 2, 2026.

7.1. Submit a written document that communicates the Respondent's interest in and capacity to address the anticipated needs identified in Section 4, “Anticipated Statement of Needs,” and the information requested in Section 5, “Specific Information Requested.”

Respondents shall complete Attachment D, Assessment Platform Requirements Response Matrix, to the extent applicable to the solution or capabilities addressed in their response, including the requirements response matrix and requested QTI information, in accordance with the instructions provided in Section 5. PWCS welcomes complete or partial responses, and identification of a requirement as Partially Supported, Not Supported, or Planned/Future Enhancement will not, by itself, preclude consideration of the Respondent's information for purposes of this RFI.

Respondents are encouraged to identify alternative approaches, capabilities, emerging functionality, or other recommendations that may assist PWCS in understanding available solutions and developing potential future requirements.

The Respondent's written response should be organized in the same order and identified with headings consistent with the sections presented herein. Supporting documentation may be included or referenced where appropriate.

7.2. Vendor’s electronic response should be organized in the following order:

• RFI, Page 2, completed and signed

• Vendor’s response to Section 5, Specific Information Requested

• Vendor’s response to Section 6, Estimated Non-Binding Pricing

• Attachment D, Assessment Platform Requirements Response Matrix, completed to the extent applicable

• Supporting documentation, if provided

• Proprietary Information Form, Attachment A

8. SUBMISSION OF INFORMATION TO RFI:

8.1. Proprietary Information: Trade secrets or proprietary information submitted by a respondent in connection with this procurement transaction shall not be subject to public disclosure under the Virginia Freedom of Information Act; however, the respondent must invoke these protections upon submission of the data or the materials and must identify the data or other materials to be protected and state the reason why protection is necessary. [Virginia Code Section 2.2-4342(F)].

Respondents shall submit on the Proprietary Information Form (Attachment A), any information considered by the respondent to be trade secrets or proprietary information, shall clearly identify the information as trade secrets or proprietary information and shall state the reason why protection is necessary. Respondents may not declare the entire response proprietary, nor may they declare proposed pricing to be proprietary. References may be made within the body of the response to proprietary or trade secret information however, any information not listed on the Proprietary Information Form shall be public information.

8.2. Vendors may also include brochures, product sheets, or other descriptive materials that illustrate the functionality, features, and benefits of their proposed solutions.

8.3. Respondents should clearly identify and describe the products, services, and capabilities addressed in their response. Responses should provide sufficient, well-organized information for PWCS to understand available solutions and relevant limitations, dependencies, and implementation considerations.

PROPRIETARY INFORMATION

RFI-AW-27400– Assesment Platform

Ownership of all data, materials, and documentation originated and prepared for Prince William County Public Schools pursuant to the Request for Information shall belong exclusively to Prince William County Public Schools and be subject to public inspection in accordance with the Virginia Freedom of Information Act. Trade secrets or proprietary information submitted by a Respondent shall not be subject to public disclosure under the Virginia Freedom of Information Act, however, the Respondent must invoke the protections of Section 2.2-4342F of the Code of Virginia, in writing, either before or at the time the data or other material is submitted. The written notice must specifically identify the data or materials to be protected and state the reasons why protection is necessary. The proprietary or trade secret material submitted must be identified by some distinct method such as highlighting or underlining and must indicate only the specific words, figures, or paragraphs that constitute trade secret or proprietary information.

NOTICE OF PROPRIETARY INFORMATION

Confidentiality References Protection in Accordance with the Code of Virginia, Section 2.2-4342F

Section Title Page Number

Reason(s) for Withholding from Disclosure

INSTRUCTIONS: Identify the data or other materials to be protected and state the reasons by using the codes listed below. Indicate the specific words, figures, or paragraphs that constitute trade secrets or proprietary materials.

A. This page contains information relating to "trade secrets', and "proprietary information" including processes. Operations, style of work, or apparatus, identify confidential statistical data, amount or source of any income... of any person (or) partnership. "See Virginia Public Procurement Act. Section 2.2-4342F. Unauthorized disclosure of such information would violate the Trade Secrets Act 18 U.S.C. 1905.

B. This page contains proprietary information including confidential, commercial or financial information which was provided to the Government on a voluntary basis and is of the type

Attachment A that would not customarily be released to the public. See Virginia Public Procurement Act, Section 2.2-4342F; 5 U.S.C. 552(b)(4); 12 C.F.R. 309.5(c)(4).

C. This page contains proprietary information including confidential, commercial or financial information. This disclosure of such information would cause substantial harm to competitive position and impair the Government's ability to obtain necessary information from contractors in die future. 5 U.S.C. See Virginia Public Procurement Act. Section 2.2- 4342F; 552(b)(4); 12 C. F. R 309.5(c)(4).

Firm Name: Date:

Signature: Title: ____

Name (Printed): Email: ___________________________

Telephone: _______________________________________

Prince William County Public Schools (PWCS) Requirements for Learning Systems Interoperability PWCS is committed to maintaining a teaching and learning technology ecosystem that is both standards-based and fully interoperable. All learning systems must comply with the certification requirements and specifications for each applicable 1EdTech Consortium standard referenced in the Required 1EdTech Certifications section. For required 1EdTech standards, partners must provide their 1EdTech certification numbers. If certification is still in progress, partners should submit a statement with the expected timeline for completion. PWCS encourages partners to keep their certifications up to date with new versions and relevant extensions.

PWCS prefers that learning systems also obtain certification for the 1EdTech Consortium standards listed in the Preferred 1EdTech Certifications section, although this is not mandatory.

Integrating with the PWCS Digital Ecosystem

Student and Staff Devices (iPadOS, Windows, and MacOS) All PWCS students - PreK through Grade 12 - use iPads as their primary learning device. All prospective partner products must be optimized for iPad deployment, ensuring full functionality and a seamless user experience on iPadOS.

If an iPad app is required for the software to function properly, prospective partners must configure app launches (for example, from ClassLink) so that the iPad app opens directly and all product components function as expected.

Prospective partners should also ensure compatibility with Windows and MacOS devices, as these are used in staff deployments.

Learning Object Repository (SAFARI Montage) PWCS requires all instructional content providers to integrate with SAFARI Montage, our central learning object repository (LOR). Integration is achieved through ingestion of a Thin Common Cartridge (TCC 1.3) and deployment of a Learning Tools Interoperability (LTI 1.3 Advantage) tool.

Prospective partners must work collaboratively with SAFARI Montage to develop an integration that meets PWCS specifications. SAFARI Montage can provide prospective partners with a sandbox environment and with guidance on TCC development and LTI 1.3 integration.

Prospective partners must follow this flow to establish a working relationship with SAFARI Montage:

1. Submit a TCC to SAFARI Montage via email: tcc@safarimontage.com.

Attachment B https://www.1edtech.org/standards/details mailto:tcc@safarimontage.com

2. Upon receipt of a TCC, SAFARI Montage will create a sandbox environment for the publisher/provider and schedule a call to review the publisher/provider’s TCC submission.

3. SAFARI Montage will provide recommendations for TCC improvement.

4. SAFARI Montage can provide guidance on LTI 1.3 Advantage tool configuration and TCC development.

SAFARI Montage Proof of Integration PWCS requires prospective partners to provide proof of integration with SAFARI Montage. This is defined as:

1. A sample TCC with complete metadata, ingested into SAFARI Montage

a. The sample TCC must contain at least one unit and one lesson to establish proof of integration.

2. An LTI 1.3 Advantage tool, installed in SAFARI Montage

a. An LTI 1.3 Advantage tool is required to establish proof of integration.

SAFARI Montage Co-Rostering Requirements:

PWCS prefers rostering on the fly via LTI launch. However, if a prospective partner solution requires co-rostering, this must be disclosed during the integration process. Prospective partners requiring co-rostering must co-roster with ClassLink to ensure seamless user management. Additionally, if co-rostering is required, the prospective partner must ensure that all unenrolled instructional staff and instructional administrators have access to materials in SAFARI Montage.

Single Sign-On and Rostering (ClassLink) Prince William County Public Schools (PWCS) utilizes ClassLink as the district’s single sign-on (SSO) and rostering platform. All prospective partner applications must establish SSO integration with ClassLink using one of the following protocols: SAML, LTI, or OAuth 2.0.

If the application supports rostering, it must integrate with ClassLink to roster students, teachers, and administrators using OneRoster 1.1 (or newer) standard format. Prospective partners must ensure their solution supports students and staff assigned to multiple schools or locations (orgs), enabling accurate rostering and access management across all relevant orgs.

Prospective partners can establish a working relationship with ClassLink by becoming a ClassLink Partner.

Once engaged as a partner, ClassLink can provide guidance on SSO and rostering configurations.

https://www.classlink.com/company/partners https://www.classlink.com/company/partners

Required 1EdTech Certifications Thin Common Cartridge (TCC) 1.3

• All partners are required to tag assets in a specific format with the asset’s source, information, type, use, content keywords, and state standards.

• All prospective partners must include the following metadata elements at the manifest level:

ο GUID, Title, Description, Keywords, Copyright, Mapping to Curriculum Standards, Extension (if applicable)

• All prospective partners must include the following metadata elements at the resource level:

ο GUID, Role, LTI URL, Resource URL, Title, Description, Keywords, From Grade, To Grade, Copyright, Type, AccessPermission, UseType, Visibility, Thumbnail, Mapping to Curriculum Standards (as applicable), Extension (if applicable)

Learning Tools Interoperability (LTI) 1.3 and LTI Advantage Services

• Prospective partners must specify the LTI extensions (Deep Linking, Names and Role

Provisioning Service, and Grades and Assignment Services) that each tool or system supports and holds certification.

• Data generated by student/faculty interaction with LTI provider tools is student/faculty data, whose stewardship is the responsibility of the institution of which those individuals are members. All platform and tool providers will provide PWCS with a copy of this data upon the request of the institution and in a format, such as Caliper Analytics, specified by the institution.

• Any features of the specified LTI version not supported by the tool, or if there are custom parameter substitution variables supported, these should be communicated to 1EdTech and

PWCS.

• All prospective partners are required to disclose what parameters, variables, and services the tool requires, so it can be matched and supported by the tool consumer or tool provider. The partner is also required to disclose optional services used.

OneRoster 1.1

• Partners should provide product certification for OneRoster 1.1 (or subsequent version), including the Class Roster, Gradebook Results, and Resources services.

Preferred 1EdTech Certifications

Question & Test Interoperability (QTI) 2.1 Assessments (tests and items) should be provided in QTI 2.1 format (or newer) for ingestion into our assessment management system. QTI integration must include complete assessments, organized with their full structure, sections, and specific question settings. Prospective partners are required to deliver assessments as coherent units, not as standalone items, ensuring that each assessment includes all relevant metadata, section organization, and configuration details necessary for accurate import and deployment.

Partners should describe how their assessments and items conform to QTI standards, including how assessment structure, sections, and question-level settings are represented in the QTI package.

Systems handling assessment content should have 1EdTech QTI 2.1 (or newer) certification.

• Summative assessments (tests and items) should be provided in QTI 2.1 format (or newer) for ingestion into our assessment management system.

• Partners should describe how their assessments and items conform to QTI standards.

• Systems handling assessment content should have 1EdTech QTI 2.1 (or newer) certification.

Competencies and Academic Standards Exchange (CASE) Standards

PWCS is a CASE publisher and prefers that prospective partners align digital content and resources to academic standards using CASE format. Where applicable, content should reference CASE-based identifiers, especially when state academic standards are published on the CASE Network by the Virginia Department of Education or published by Prince William County Public Schools.

Prospective partners are encouraged to:

• Ensure all instructional materials and resources are mapped to relevant standards using CASE identifiers.

• Provide documentation describing how their solution supports CASE alignment and integration.

• Remain current with updates to CASE standards and implement changes within six (6) months of public release.

Curriculum LOR (C-LOR) Integration (SAFARI Montage) When digital learning objects are licensed in association with a course, PWCS requires that those materials be made available in C-LOR and meet the required and recommended C-LOR requirements and meet the minimum and/or recommended course integration. The TCC metadata provided within the cartridge will facilitate creating the course and digital resource alignment.

Required Course Construction Metadata Folders (structure) - The underlying organizational structure of a folder is expressed as either (i) a folder representing a hierarchical structural level of a course such as a unit, chapter, or lesson; (ii) a folder representing a set of learning objects intended to be viewed in a linear ordered sequence such as a playlist; or (iii) a folder simply representing a collection of learning objects.

https://casenetwork.1edtech.org/ https://pwcs.satchelcommons.com/

SAFARI Montage implements the following based on the folder structure attribute:

• hierarchical – a folder designated as hierarchical is imported as a structural level in the imported course, i.e., a unit, chapter, or lesson, using the folder name and description as the name and description of the course unit, chapter, or lesson

• collection – the name of a folder designated as a collection of learning objects is appended to the name each of the learning object contained within the folder, e.g., Learning Object Name (Folder Name)

• linear – a folder designated as linear is imported as a playlist, using the folder name and description as the playlist name and description

Title (title) – a clear and unique title Description (description) - clear and meaningful description for the unit, chapter, lesson, or playlist, including its main topic(s).

Grade Level (typicalAgeRange) - academic grade level or range (not student age) of the folder.

Learning or Teacher Resources (intendedEndUserRole) - This metadata determines whether a given folder is designated as a collection of Lesson Learning Resource or Lesson Teacher Resource when the folder is used in the construction of a C-LOR Course. See the mapping below if metadata is included.

Recommended Additional Course Construction Metadata Playlist Learning Resource Type - (learningResourceType) - SAFARI Montage categorizes format and Learning Resource Type in a specific way. Folders that include LRT metadata will be categorized in the LOR search results by their intended use or by format. This is only applicable to playlists and learning objects when using a cartridge to construct a course. Note that the SAFARI Montage defined LRTs include:

• Assessment

• Interactive

• Lesson

• Lesson Plan

• Professional Development

• Teacher’s Guide

Standards – Formatted standard correlations for the playlist or target standards for course levels such as Unit, Chapter, or Lesson as either Academic Benchmark or CASE GUIDs. Correlations should not be applied en masse without specific review.

PWCS - ASP Form

Version 5 8/31/22 1

Application Service Provider (ASP) Security Standards

Prince William County Public Schools

Version 5. Updated: August 31, 2022

Name of company:

URL:

Company Contact Name:

Company Contact email:

Company Contact phone number:

Product:

Product Description:

PWCS POC:

1.0 Overview

This document defines the information security criteria that an Application Service Provider (ASP) must meet in order to be considered fit for use by Prince William County Schools. As part of the ASP selection process, the ASP Vendor must demonstrate compliance with the Standards listed below by responding in writing to each statement and question in the six categories. Information Security will review the vendor responses and will suggest remediation measures in any areas that fall short of the minimum-security criteria. Prince William County Schools Information Security approval of any given ASP rests largely on the vendor's responses to this document.

Standards are structured to provide due diligence and compliance with applicable state and federal laws, and to protect confidentiality and privacy of student and staff information during collection, transfer, storage, disclosure, and destruction, when using an Application Service Provider.

These Standards are subject to additions and changes without warning by Prince William County School’s

Department of Information Technology.

2.0 Scope

This document is intended to be provided to ASPs that are either being considered for use by Prince William

County Schools or have already been selected for use. Staff interested in purchasing online software services that include staff or student data, or require logins, should provide this document to the vendor to complete.

Attachment C

Version 5 8/31/22 2

3.0 Responding to These Standards

Information Security is looking for explicitly detailed, technical responses to the following statements and questions. ASPs should format their responses directly beneath the Standards (both questions and requirements) listed below. In addition, please include any security whitepapers, technical documents, or policies that you may have. ASPs that have comprehensive information that addresses all areas in this form may submit a separate document and/or link to this information but should also indicate where the specific information can be located for ease of PWCS staff review.

Answers to each Guideline should be specific and avoid generalities, e.g.:

Examples:

Bad: "We have hardened our hosts against attack."

Good: "We have applied all security patches for Windows Server 2016 as of 8/31/2020 to our servers. Our

Administrator is tasked with keeping up to date on current vulnerabilities that may affect our environment, and our policy is to apply new patches during our maintenance period (2300hrs, Saturday) every week.

Critical updates are implemented within 24 hours. A complete list of applied patches is available to Prince

William County Schools.”

Bad: "We use encryption."

Good: "All communications between our site and Prince William County Schools will be protected by IPSec

ESP Tunnel mode using 256 AES encryption, SHA-1 authentication, or better, as determined by PWCS. We exchange authentication material via either out-of-band shared secret, or PKI (Public Key Infrastructure) certificates."

* Do not insert graphics, diagrams, or URLs into this document. Please send as attachments and reference said attachments within the responses in this document.

* Do not reference a whole document to satisfy a response. Please articulate the response and reference the attached document within the response.

4.0 Standards

4.1 General Security

1. Prince William County Schools reserves the right to periodically (annually, typically) request the vendor provide an overview of changes to the infrastructure.

2. The ASP must provide a proposed architecture document that includes a full network diagram of the

Prince William County Schools Application Environment, illustrating the relationship between the

Version 5 8/31/22 3

Environment and any other relevant networks, with a full data flowchart that details where Prince

William County School data resides, the applications that manipulate it, and the security thereof .

3. Describe the process and timeline you will utilize to notify PWCS should a data breach be discovered.

Please include the company POC who will notify PWCS and what the notification will be. Please describe how the notification will take place and in what format. Please describe details on how PWCS will have on-going and near real time updates. Please describe how PWCS can make changes to update notification contacts, if needed.

4. Please disclose third party services and or applications you use/integrate into your product

5. Has your company, or third-party vender application used by your service or application, been a victim of a malware incident to include ransomware or a security breach? Advise if an attacker successfully gained access to your or third-party network and if data was exfil/taken. If applicable, please attach a copy of the data security breach notice/letter.

6. Does your product or service advertise, communicate, solicit students, parents, or staff to inform, influence or enable marketing or advertising efforts while using your product or service? (This includes marketing adds to include third party, membership upgrades, and/or account creation.)

4.2 Physical Security

1. The infrastructure (hosts, network equipment, etc.) hosting the Prince William County Schools application must be located in the United States and contained in a locked cage-type environment. A

Tier 2 data center (or better) or Cloud Service Provider, such as AWS, Google, or Azure physical infrastructure is preferred.

4.3 Network Security

1. The infrastructure hosting the application must keep PWCS’ data separate from other customers’ data.

This can be done through physical (airgap, separate servers, etc.) or logical (VLAN, subnets, security tags, virtual hosts, etc.) means. Describe how this is accomplished.

2. All Prince William County Schools data must always be encrypted while in transit, while in use and at rest, without exception. Describe how this is accomplished.

Version 5 8/31/22 4

4.4 Host Security

1. The ASP must disclose how and to what extent the hosts (Unix, Windows, etc.) comprising the Prince

William County Schools application infrastructure have been hardened against attack.

2. The ASP must provide a current patch level on hosts, including host OS (Operating System) patches, web servers, databases, and any other material application.

3. Information on how and when security patches will be applied must be provided. How does the ASP keep up on security vulnerabilities, and what is the policy for applying security patches?

4. The ASP must disclose their processes for monitoring the integrity and availability of those hosts .

5. The ASP must provide information on their password policy for the Prince William County Schools application infrastructure, including minimum password length, password generation guidelines, how often passwords are changed, and if MFA (Multi-Factor Authentication) options are available.

6. How will the ASP authenticate users? What options exist (Local/manual, SSO, SAML, Clever, etc.)?

7. What data from our SIS (Student Information System), HRIS (Human Resources Information System), and/or ERP (Enterprise Resource Planning) systems will be needed? Does this application require rostering of students, teachers, classes, etc.? If so, please describe the methods available for receiving/exchanging this data (e.g., CSV, API, One Roster, Clever, etc.). Are you IMS Global Certified

(https://site.imsglobal.org/certifications)? Also, provide information on the account generation, maintenance and termination process, for both maintenance as well as user accounts . Include information as to how an account is created, how account information is transmitted back to the user, and how accounts are terminated when no longer needed.

8. Please describe how employees will access the data systems containing PWCS data? Are there security controls to monitor and log employee access? What access controls are in place to limit employee access (e.g. RBAC, ABAC, etc.)

Version 5 8/31/22 5

4.5 Web Security

1. Please describe the ASP’s process for doing security Quality Assurance testing and reviewing new vulnerabilities for the application and underlying code. For example, testing of authentication, authorization, and accounting functions, as well as any other activity designed to validate the security architecture, as well as reviewing CVEs. How do you adhere to the OWASP Application Security

Verification Standard and/or the NIST Guidelines for Securing Public Web Servers (SP 800-44 V2)?

4.6 Cryptography

1. Encryption algorithms must be 256 AES or its equivalent. If the encryption is proposed as an equivalent, PWCPS will make the determination of equivalency in its sole discretion. PWCPS reserves the right to change or increase the level of the required encryption with 30 days advance notice to the ASP.

2. Connections to the ASP utilizing the Internet must be protected using any of the following cryptographic technologies: IPsec, SSL/TLS, SSH/SCP, PGP.

3. Describe what security awareness training is conducted with the ASP to ensure staff are knowledgeable about social engineering, phishing, and other cyber threats that may make PWCS’s data at risk.

4. Explain how the ASP wipes data so that it cannot be recovered and what, if any procedures must be followed to sanitize PWCS data upon termination of using the application. Also provide the delivery process upon request or termination on how data will be returned to PWCS, if so requested.

4.7 Business Continuity

1. Please describe your Service Level Agreement (SLA), identifying the Recovery Time Objectives (RTO) and Recovery Pint Objective (RPO).