ICRAS PWS v14a 2.27.25 .docx

DOCX document 527 KB Posted

Attached to
Request For Information for Information Collection Request, Review & Approval System Maintenance and Support (ICRAS)
Solicitation number
AP_2519
Issued by

View the file

Other files

File Type Posted
RFI- ICRAS 022725.docx DOCX document

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

Performance Work Statement

Information Request Review and Approval System Maintenance and Support

February 27, 2025

Table of Contents

Applicable Directives and Legislative Authority3
Applicable Acronyms4
I.Introduction5
Purpose of Procurement5
Background6
Information Collections6
Period of Performance7
II.Scope of Work7
TASK 1: POST AWARD MEETING (BASE PERIOD ONLY)7
TASK 2: PROJECT MANAGEMENT (ALL PERIODS)7
TASK 3: ICRAS TESTING (BASE YEAR AND OPTION YEARS)7
TASK 4: ICRAS OPERATIONS, MAINTENANCE AND SUPPORT (ALL PERIODS)8
TASK 5: ICRAS SECURITY (ALL PERIODS)10
Task 6: Transition Out Period11
III.Contract Personnel11
IV.Deliverables13
V.Government Furnished Property/Equipment/Information14
VI.Place of Performance14
VII.Operating Constraints14
VIII.Other Information15
TECHNICAL EXHIBIT 1 – SCHEDULE OF DELIVERABLES17

Performance Work Statement Office of Planning, Evaluation and Policy Development Office of the Chief Data Officer Strategic Collections and Clearance Information Collection Request, Review & Approval System Maintenance and Support

Applicable Directives and Legislative Authority

1. P.L. 103-14 - Paperwork Reduction Act

2. 34 CFR Part 5b – Privacy Act Regulations

3. Administrative Communications System (ACS) Directive ACSD-OPEPD-001 (8/19/2023) “Information Collection Activities and Burden Control”

4. Administrative Communications System (ACS) Directive ACSD-OPEPD-004 (2/7/2022) “Privacy Act of 1974 (Basic Requirements) and the Collection of Personal Information”

5. Defense Information Systems Agency STIGs

6. Federal Information Management Security Act of 2014

7. OMB Memorandum M-17-12

8. NIST 800-47 – Security Guide for Interconnecting Information Technology Systems

9. NIST 800-53 - Recommended Security Controls for Federal Information Systems and Organizations

10. Privacy Act of 1974, PL 93 579, 5 U.S.C. 552a

11. OMB Guidelines for Ensuring and Maximizing the Quality, Objectivity, Utility, and Integrity of Information Disseminated by Federal Agencies, February 22, 2002

12. Foundations for Evidence-Based Policymaking Act of 2018

Applicable Acronyms

1. Application Programming Interface (API)

1. Authority To Operate (ATO)

1. Change Advisory Board (CAB)

1. Change Management Board (CMB)

1. Contracting Officer (CO)

1. Contracting Officer’s Representative (COR)

1. U.S. Department of Education (Department)

1. Data Catalog Version 3 (DCAT3)

1. Defense Information Systems Agency (DISA)

1. Earned Value Management (EVM)

1. Education Data Inventory (EDI)

1. Enterprise Investment Management Board/Enterprise Review Board (EIMB/ERB)

1. Federal Risk and Authorization Management Program (FEDRamp)

1. Federal Information Security Management Act (FISMA)

1. Government Off the Shelf (GOTS)

1. Information Assurance Services (IAS)

1. Information Collection Request Review and Approval System (ICRAS)

1. National Institute of Standards and Technology (NIST)

1. National Security Agency (NSA)

1. National Center for Education Statistics (NCES)

1. Office of the Chief Information Officer (OCIO)

1. Office of Management and Budget (OMB)

1. Office of Information and Regulatory Affairs (OIRA)

1. Public Data Product System (PDPS)

1. Office of Planning, Evaluation and Policy Development (OPEPD)

1. Paperwork Reduction Act (PRA)

1. Performance Work Statement (PWS)

1. Plan of Action and Milestones (POAM)

1. Privacy Impact Assessment (PIA)

1. Privacy Threshold Assessment (PTA)

1. Security Technical Implementation Guidelines (STIGs)

1. Regulatory Information Service Center and Office of Information and Regulatory Affairs Consolidated Information System (ROCIS)

1. Work Breakdown Structure (WBS)

I. Introduction

The U.S. Department of Education promotes student achievement and preparation for global competitiveness by fostering educational excellence and ensuring equal access.

Under OPEPD, the Office of the Chief Data Officer is responsive to the strategic data needs of the Department by developing and enforcing data governance policies, setting the standard for analytic excellence, informing decision making, and fostering an enterprise-wide data culture.

The Strategic Collections and Clearance team (SCC) oversees the Department’s information collection request (ICR) clearance process and forms management. The organization ensures its requests adhere to the Paperwork Reduction Act (PRA) of 1995 and the Privacy Act of 1974.

SCC is charged with the implementation, and ongoing execution of the Department’s Information Collection Request Review and Approval System (ICRAS). The Department’s ICRAS system allows OCDO to manage a standardized review process to support improvements in the management of education program requirements, improve the quality of ICR documents by providing training and technical assistance to all ED offices as they prepare ICRs for submission, then to do a manual transfer of all ED ICRs to OMB/OIRA’s information system (further explained below) to facilitate OMB/OIRA review. The purpose of the Department’s system, Department’s review process, and OMB/OIRA’s system and process are to meet process and content requirements from the PRA.

Purpose of Procurement

The purpose of this procurement is to provide support for the maintenance and support of ICRAS using a Federal Risk and Authorization Management Program (FEDRamp) certified Cloud service provider for the benefit of the Department.

The Department has a requirement to operate and maintain ICRAS in a cloud-based environment and make it available for use by Department staff. The ICRAS maintenance and support contract is a performance-based contract. As such, desired outcomes, performance standards and measurements are used to set expectations and to monitor the performance of this contract.

ICRAS is composed of Amazon Linux (AL2), Ruby on Rails v5.2.8.1, Ruby 2.7.8p225, Puma 5.5.2, RVM 1.29.12 and MySQL 15.1 Distrib 5.5.68.

Background

Information Collections

The Paperwork Reduction Act (PRA) of 1995 (Public Law 104-13) took effect on October 1, 1995, replacing the Paperwork Reduction Act of 1980 (as amended in 1986). As a result of this reauthorization, the Office of Management and Budget (OMB) published proposed changes to 5 CFR 1320 in a Notice of Proposed Rulemaking on June 8, 1995, and published a final rule on August 29, 1995. The rule interprets the PRA and provides specific mandatory compliance guidelines for federal agencies. The PRA and supporting rules dictate that each agency ensure that the collection of information imposes the smallest possible burden on the public, is not duplicated elsewhere, has practical utility, and is necessary to satisfy statutory requirements or other substantial government needs. Each agency must carry out compliance and requirements of the Act. In addition, the PRA and 5 CFR Part 1320 require that agencies prepare and submit to the OMB an annual Information Collection Budget (ICB). The ICB serves as the major planning and management tool to assist agencies in efficient management of information resources. The regulations also specify OMB’s requirements for submission of information collection requests, the clearance approval process, and the timeframes for obtaining clearance.

SCC is responsible for assessing and improving management of the Department’s information collections and reducing the burden placed on the public by information collections. The Department’s program offices use survey questionnaires, focus groups, grant and loan application forms, performance report forms and other information collection formats or activities to collect information from postsecondary institutions, state and local education agencies, schools, parents, and students. SCC is responsible for ensuring that any information collected is: (a) required to support an Agency need; (b) designed such that it will meet that need; (c) not duplicated by another collection; and (d) not overly burdensome on the public. SCC is also tasked with docket management duties that process information collection requests (ICRs) from the intake to the close-out throughout the lifecycle of an ICR, including using systems to publish requests during open public comment periods.

The Department is responsible for tracking its information collection requests and their associated annual responses, hours, and costs utilizing the Information Collection Request, Review & Approval System (ICRAS).

ICRAS was developed as a Government Off-the-Shelf (GOTS) software application used by agencies to fulfill their Office of Management and Budget (OMB) mandated information clearance requirements. OMB determines the elements needed for the ROCIS; many of which are reflected in ICR supporting statements. The Department’s ICRAS system aligns with the ROCIS requirements to ensure ICRs include all information required for PRA submissions.

Period of Performance The period of performance of this task order shall be: one (1) twelve-month base period and 3 twelve-month option periods.

II. Scope of Work

TASK 1: POST AWARD MEETING (BASE PERIOD ONLY)

The Contractor shall meet for one day virtually with the Contracting Officer’s Representative (COR), the Contracting Officer (CO) and/or his/her representative, Deputy Chief Data Officer and SCC Program Manager totaling not more than 10 participants, within seven (7) business days after the effective date of the contract award. No food or beverages will be provided for this meeting.

The purpose of this post-award kick-off meeting is to clarify the work to be performed and the procedures to be followed by the Contractor. The CO’s Representative will identify a time and place for the meeting and will be responsible for inviting appropriate Department staff. The Contractor shall contact the COR within three (3) days of the effective date of the contract award to make arrangements for the meeting and to set the agenda with the COR. A virtual call will be arranged by the government.

TASK 2: PROJECT MANAGEMENT (ALL PERIODS)

Sub-Task 2.1: The Contractor shall develop a project management plan that manages all tasks under this Performance Work Statement (PWS) for:

· Schedule

· Quality

· Performance

Sub-Task 2.2: The Contractor shall develop and update a Work Breakdown Structure (WBS) containing all work activities. The WBS shall define all work contained under this PWS.

TASK 3: ICRAS TESTING (BASE YEAR AND OPTION YEARS)

The Contractor shall perform the following series of tests on the Cloud-based ICRAS system under this contract:

Sub-Task 3.1: Section 508 Testing

The Contractor shall perform testing to ensure compliance with Section 508 when major changes or new modules are deployed within ICRAS.

Sub-Task 3.2: ICRAS Operational Testing

The Contractor shall perform operational testing related to ICRAS when major changes or new modules are deployed within ICRAS. The Contractor shall also support user acceptance testing of ICRAS after deployment. Testing shall ensure an integrated operational system that meets all functional requirements with the appropriate operational capability, and correct sizing, performance, and stability. The Contractor shall provide a test procedure for tests when applicable.

Sub-Task 3.3: ICRAS Load Testing

The Contractor shall perform load testing to verify those functional requirements related to system load. The Contractor shall provide a test procedure for this test and the results from testing.

Sub-Task 3.5: Monthly Security Vulnerability Testing

The Contractor shall participate with OCIO IAMT testing of operational, application and database testing. The Contractor shall support vulnerability testing. Findings from testing and/or POA&Ms should be addressed within 10 business days of receipt.

TASK 4: ICRAS OPERATIONS, MAINTENANCE AND SUPPORT (ALL PERIODS)

Sub-Task 4.1: The Contractor shall deliver an updated ICRAS Administration Manual that describes how to perform system administrative functions such as backups and user account creation for the ICRAS application. The Contractor shall provide this document following successful deployment of major changes to ICRAS. Revisions to the manual should be made annually.

Sub-Task 4.2: The Contractor shall evaluate project progress, interoperability policies, practices and procedure documents and testing reports, as well as provide programmatic and technical assistance as required during biweekly meetings and attend other meetings upon request.

Sub-Task 4.3: The Contractor shall establish and support an ICRAS Change Management Board (ICRAS CMB) to provide project management and technical support for the review, approval and tracking of system change requests.

Sub-Task 4.4: Department of Education Change Management Change Advisory Board (CAB) Meeting Support

The Contractor shall participate in Department of Education Change Management CAB meetings for which ICRAS has pending requests to obtain approval for major changes. While CAB meetings are held on a monthly basis, there is no requirement to attend all meetings. The Contractor shall be available to answer technical questions about the architecture, development and environment where ICRAS is maintained. The Contractor shall be responsible for the development and review of necessary documentation for all meetings. The Contractor shall be responsible for deployment of major changes to ICRAS upon CAB approval.

Sub-Task 4.5: The Contractor shall manage the ICRAS application within a secure network infrastructure environment equipped with environmental controls, uninterruptible power supplies and physical security systems.

Sub-Task 4.6: In accordance with the NIST SP 800-60, and with the Cyber-Security Risk Management Framework (CRMF), and with the U.S. Department of Education’s (ED’s) OCIO: 03-112, ‘Cyber-Security Policy,’ when applicable, the contractor shall support the Information System Owner (ISO) and the Information System Security Officer (ISSO), in categorizing information systems, selecting security controls, inheriting security controls, offering security controls for inheritance, and implementing security controls through the authoring / editing, and validation of security control implementation statements, as well as in the creation and editing of all security documentation and artifacts needed for system security assessment, and for security authorization.

Sub-Task 4.7: The Contractor shall conduct nightly and weekly incremental backups.

Sub-Task 4.8: The Contractor shall work with the Department to perform firewall management tasks and perform routine and one-off operating system, database, and firewall maintenance within agreed-upon maintenance windows.

Sub-Task 4.9: The Contractor shall provide the Department monthly vulnerability scans summarizing incidents/actions affecting confidentiality and integrity of data in ICRAS and/or availability of the system.

Sub-Task 4.10: The Contractor shall establish and manage interconnection requirements including incident response and contingency planning in accordance with National Institute of Standards and Technology (NIST) 800-47.

Sub-Task 4.11: The Contractor shall implement system upgrades and maintenance patches according to a configuration management plan agreed to by the Department and schedule these events in the least disruptive manner possible.

Sub-Task 4.12: The Contractor shall communicate system maintenance events to the Department via system messages, telephone and/or email.

Sub-Task 4.13: The Contractor shall provide ICRAS helpdesk support for technical system issues accessible via published email address between regular business hours of 8:00 AM – 5:00 PM (Eastern) Monday through Friday.

Sub-Task 4.14: The Contractor shall provide the agency its data upon request, in an approved method/format, including but not be limited to database tables and Information Collection Request files such as forms, supporting statements, federal register notices, and information collection instruments.

TASK 5: ICRAS SECURITY (ALL PERIODS)

Sub-Task 5.1: The Contractor shall provide support with maintenance of documentation necessary to support continuous security authorization in accordance with Department requirements as identified in Standard ID.GV – Required Authorization Documentation. The Contractor shall be available for interviews and demonstrations of security control compliance to support the security authorization process.

Sub-Task 5.2: The Contractor shall comply with the Department's IT security policy requirements as set forth in the Cybersecurity Policy and related procedures and guidance.

Sub-Task 5.3: The Contractor shall comply with IT security requirements as outlined in the Federal Information Security Management Act of 2014 (FISMA), OMB Circulars, and NIST standards and guidance. This also includes the Defense Information Systems Agency (DISA) Security Technical Implementation Guidelines (STIG) as set forth by the National Security Agency (NSA).

Sub-Task 5.4: The Contractor shall design and implement security controls in the system consistent with the most current finalized version of the NIST 800-53 - Recommended Security Controls for Federal Information Systems and Organizations identified for the impact level of the system.

Sub-Task 5.5: The Contractor shall support the Department's OCIO IAMT in conducting vulnerability scanning and penetration testing on the hosting facility and application, as part of the security authorization process.

Sub-Task 5.6: The Contractor shall provide appropriate access agreements before any scanning or testing occurs.

Task 6: Transition Out Period

There will be up to a 30-day transition-out period to facilitate the effective and efficient transfer of on-going activities to the new Contractor to ensure continuity of work.

Subtask 6.1. The Contractor shall provide support in the transfer of documentation, databases, codebases and other related materials in the management of the Department’s inventory of forms and information collections.

Subtask 6.1.1: The Contractor shall provide copies of the ICRAS database, coded modules, file stores, reporting templates, document repository, and other materials used in the performance of these functions.

III. Contract Personnel

Basic Requirements

The Contractor shall provide a Contract Performance Team comprised of individuals fully qualified to perform the specific work requirements described in this PWS. The specific performance requirements are described in the “Qualifications of Staff” section of this PWS.

Contractor personnel shall meet the criteria for eligibility to receive a Department security clearance and must maintain confidentiality of all work processes.

Contractor personnel shall be responsible for answering the telephone and dealing with Department employees, other programs and organizations. The Contractor shall be customer-service oriented and should easily understand the English language both verbally and in writing.

Contractor personnel shall demonstrate mastery of the components of the Microsoft Office Suite of applications relevant for the work they are performing under the Tasks of this PWS. As the majority of the work to be performed under this PWS will be done in a virtual office environment, Contractor personnel must demonstrate mastery of collaboration tools for document management and collaboration and have the ability to track correspondence and documents through multiple rounds of stakeholder review, consolidating, synthesizing, and prioritizing comments and edits as they are received.

Contractor personnel shall be familiar with and experienced in standards of accessible product development and alternate forms of communication and dissemination, as required by Section 504 of the U.S. Rehabilitation Act (as amended) (29 U.S.C. 794 d).

Security

The work performed in accordance with this PWS is “business sensitive” and confidential. As such, all Contractor (and subcontractor, as applicable) personnel working on this task order are required to be cleared (and maintain security clearance), as follows:

· The Program Manager, Project Manager, and all Contractor (and subcontractor, as applicable) personnel who work on infrastructure security, information assurance, or security authorization tasks – 6C (Moderate Risk) security clearance.

Qualifications of Contractor Staff

In addition to the required qualifications for all Contractor personnel performing work under this PWS, Tasks 2 through 9 require specialized experience and/or expertise. Therefore, there are additional minimum requirements that Contractor personnel working on these tasks must meet.

In addition to the basic requirements for all Contractor personnel listed above, any Contractor employee performing work under Tasks 2 through 6 must have a BS degree (graduate degree preferred) in engineering, computer science, math or other related technical discipline. The candidate must have a minimum of 6 years’ experience exposed to activities associated with the development of a new system, from developing and analyzing system concepts, assessing system design options, analyzing requirements, monitoring development, integration and test activities, and in operations and maintenance.

Key Personnel

Because of the degree of expertise required, and the critical importance of these functions for the continued operations of OCDO, Contractor personnel assigned to perform work on the following Sub-Tasks shall be considered “Key Personnel” and shall not be replaced or re-assigned by the Contractor without prior approval by the CO. Initial assignment (or replacement) of any key personnel shall require prior approval of the individual’s qualifications by the CO.

· Tasks 2 through 8 (Project Manager)

Availability of Contractor Personnel

The tasks under this PWS require sustained availability of Contractor personnel to respond to internal and external customer requests and inquiries, and provision of technical expertise to OCDO managers and staff during Department operating hours. The requirements for this availability are detailed below.

Core Business Hours

Contractor personnel assigned to this contract shall be available to perform work under the tasks of this contract during the core business hours of 9:00AM to 5:00PM Eastern Time. On days when Department employees are granted “Early Dismissal,” these core business hours shall be reduced accordingly. At the request of the Contractor, the COR may modify these core business hours on a case-by-case basis for Contractor personnel performing work on specific tasks under this PWS.

IV. Deliverables For subtasks with formal documents as deliverables, the deadlines provided in the delivery schedule below represent deadlines for submission of final drafts of these documents. When time permits, the Contractor may submit rough drafts of these documents for review by the SCC Team prior to these deadlines. Upon receipt of a rough draft, the SCC Team will provide comments/edits to the Contractor for inclusion in the final draft within ten business days of receipt.

The following quality standards will be used to assess Contractor deliverables that are documents:

· The document is complete, correct and includes all relevant information;

· The document meets the core requirements for the document;

· The document captures the relevant points raised during its creation;

· The overall business purpose of the document is achieved;

· The document contains few grammatical errors, is visually appealing, and is easy to read/understand;

· The document uses the format and terms currently used by Department staff;

· The document contains recommendations consistent with best practices;

· The document is submitted on time and incorporates any pre-submission feedback;

· The documents are stored in the appropriate locations and are accessible by appropriate staff.

V. Government Furnished Property/Equipment/Information The Contractor shall furnish any property and/or equipment for any work pertaining to ICRAS maintenance and support tasks.

Templates used by the Department to develop documentation needed to support security authorization will be provided. Those documents include:

· System Security Plan

· System Security Risk Assessment

· Federal Information Processing Standards-199 Risk Assessment Results

· System Contingency Plan

· System Configuration Management Plan

· Security Assessment Plan

· Security Assessment Report

· Privacy Threshold Assessment (PTA)

· Data Sensitivity Inventory

· Plan of Actions and Milestones

· Interconnection Agreements

VI. Place of Performance

All work pertaining to hosting/support of ICRAS Implementation will take place at the Contractor’s facilities.

VII. Operating Constraints

1. The Contractor is required to work with OPEPD and the Department’s Office of the Chief Information Officer (OCIO) to ensure compliance with security authorization requirements of the Federal Information Management Security Act of 2002.

2. The Contractor must abide to any new regulations mandated by the Federal Government. The Government must provide any regulation documentation as needed.

3. The Contractor must communicate any sensitive system information to the Government via approved protocol (i.e. Government email).

4. The Contractor must ensure that ICRAS meets all Section 508 requirements. If after completing testing issues are detected, the Contractor must address findings within 10 business days of receiving the final accessibility report from ED’s Assistive Technology Team.

VIII. Other Information

IT PROJECT MANAGEMENT LANGUAGE

Implement IT project management practices, techniques, methodologies, and standards to facilitate the efficient and effective lifecycle management of IT projects, leveraging the Department’s Enterprise Program Management Review Framework

INFORMATION MANAGEMENT REQUIREMENTS

The purpose of this document is to impart requirements for managing and ensuring accessibility to Federal records (on any medium such as paper, systems, applications, etc.) that is made or received in connection with the transaction of Department business as part of a contract. The following requirements are divided into two sections, which are mandatory: (1) Records and CUI, (2) Accessibility requirements related to Section 508 of the Rehabilitation Act.

RECORDS AND CONTROLLED UNCLASSIFIED INFORMATION (CUI)

· "Federal record" as defined in 44 U.S.C. § 3301, includes all information, made or received by a Federal agency in connection with the transaction of public business. ED owns rights to all records produced as part of this contract. Any Contractor rights must be identified as required by FAR 52.227-11 through FAR 52.227-20.

· Federal records must be managed according to the applicable records management laws and regulations, to include the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), 36 CFR Chapter XII Subchapter B, and the Privacy Act of 1974 (5 U.S.C. 552a).

· Federal records which are CUI must additionally be managed in accordance with any applicable laws, regulations and government-wide policies (LRGWP) to include EO 13556, 32 CFR Part 2002, ED Directive OCIO 3-113, and NIST-800-171 Revision 2 (or current version).

· Applicability: This clause applies to all Contractors and sub-contractors (hereafter referred to as “Contractors”) and must be incorporated into all subcontracts.

· Training Requirements: All Contractors are required to take the annual Information Management Requirements training. If the contract includes CUI the CUI Identification and Marking Training is required. Additional Category or POC specific trainings may be assigned. Contractor will maintain completion certificates and provide upon request.

· Electronic Information System Requirements: Any electronic information system should address at minimum the following regulations in 36 CFR 1236.10. Agencies must incorporate controls into the system or integrate them into a recordkeeping system that is external to the information system itself (see 36 CFR 1236.20 for recordkeeping system functionalities). Information systems that process, store, or transmit CUI must fulfill the requirements outlined in 32 CFR 2002.14(g).

· Marking Requirements: The Contractor will mark CUI as outlined in Department training.

· Handling and Safeguarding Requirements: The Contractor will ensure that CUI is managed appropriately. The requirements include safeguarding, controlled environments, shipping and mailing or transporting protections, and reproduction protections (see 32 CFR 2002.14(a-e)).

· Contract Completion Requirements: Removal or destruction of records must be in accordance with assigned ED records schedule and must include written concurrence from the CO/COR. If records are removed or destroyed the Contractor must report the incident to ED immediately. Destruction or removal of records without the above requirements is subject to fines and penalties imposed by 18 U.S.C. 2701.

· Compliance with Information Protection Requirements: ED reserves the right to verify compliance with information security requirements established by this contract. The Contractor will fully comply with all ED-initiated inspections as permissible by law.

· Information Security Incidents (ISI) Requirements: Contractors must immediately report any and all suspected security incidents, breaches, and events involving ED information to ED’s Computer Incident Response Center (EDCIRC) email: edcirc@ed.gov, and ED’s Security Operations Center (EDSOC) email: edsoc@ed.gov; voice: 202-243-6550, regardless of whether the ISI is suspected, known, or determined to involve IT systems operated in support of this contract. In the event of an ISI, ED must be provided immediate access to all IT systems used in support of this contract for inspection and analysis.

IT ACCESSIBILITY REQUIREMENTS (SECTION 508 OF THE REHABILITATION ACT)

· Section 508 of the Rehabilitation Act, as amended by P.L. 105-220, requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Products, platforms and services delivered as part of this work statement that are or contain ICT, must conform to the Revised 508 Standards, at 36 C.F.R. § 1194.1 & Apps. A, C & D. https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

· Applicable Functional Performance Criteria: When using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT. – All requirements apply

· Applicable requirements for software features and components: All WCAG Level AA Success Criteria, 502 Interoperability with Assistive Technology, 503 Application – Applies if client server software (installed on a computer) is a part of the procurement.

· Applicable requirements to Webpage and Web Applications: All WCAG Level AA Success Criteria – Applies if websites or a web-based application (browser based) is part of the procurement.

· Applicable requirements for hardware features and components: Applies if hardware is part of the procurement. (e.g. copiers, fax machines, phones, scanner etc.)

· Applicable support services and documentation: All requirements apply.

TECHNICAL EXHIBIT 1 – SCHEDULE OF DELIVERABLES

All deliverables shall be submitted electronically, unless otherwise specified by the COR. An electronic copy of all deliverables shall be provided to the CS.

Base Year and Option Year Schedule

Task/Subtask
Deliverable
BY Due Dates

Base Year

OY1 Due Dates
OY2 Due Dates
OY3 Due Dates
OY4 Due Dates
1
Post Award Meeting Agenda
Two (2) business days prior to the meeting
No deliverable
No deliverable
No deliverable
No deliverable
1
Post Award Meeting Minutes
Five (5) business days after meeting
No deliverable
No deliverable
No deliverable
No deliverable
1
Project Management Plan
Five (5) business days after meeting
Five (5) business days after exercise of option
Five (5) business days after exercise of option
Five (5) business days after exercise of option
Five (5) business days after exercise of option
2.1
Work Breakdown Structure
Ten (10) business days after meeting
Five (5) business days after exercise of option
Five (5) business days after exercise of option
Five (5) business days after exercise of option
Five (5) business days after exercise of option
3.1
Response to Section 508 Testing
Within five (5) business days of request
Within five (5) business days of request
Within five (5) business days of request
Within five (5) business days of request
Within five (5) business days of request
3.4
CAB Documentation Review
Three (3) business days prior to the meeting
Three (3) business days prior to the meeting
Three (3) business days prior to the meeting
Three (3) business days prior to the meeting
Three (3) business days prior to the meeting
3.5
POA&M Evidence
Ten (10) business days upon review
Ten (10) business days upon review
Ten (10) business days upon review
Ten (10) business days upon review
Ten (10) business days upon review
4.1
ICRAS Administration Manual
Within ten (10) days of request
Sixty (60) business days after exercise of option
Sixty (60) business days after exercise of option
Sixty (60) business days after exercise of option
Within 5 business days after receiving request
4.3
Change Management Board Handbook
Within 60 days of award
Update within 60 days of award
Update within 60 days of award
Update within 60 days of award
Update within 60 days of award
4.14
ICRAS Database Tables and Files
Within 2 business days after receiving request
Within 2 business days after receiving request
Within 2 business days after receiving request
Within 2 business days after receiving request
Within 2 business days after receiving request
5.1
Authorization Documentation
Within 5 business days after receiving request for
Within 5 business days after receiving request for
Within 5 business days after receiving request for
Within 5 business days after receiving request for
Within 5 business days after receiving request
5.5
Scan Results
Within 5 business days after receiving request
Within 5 business days after receiving request
Within 5 business days after receiving request
Within 5 business days after receiving request
Within 5 business days after receiving request
5.6
Access Agreements
Within 30 business days of award after completion of screen and background investigation
Within 60 business days after completion of screening and background investigation due to change in risk designation
Within 60 business days after completion of screening and background investigation due to change in risk designation
Within 60 business days after completion of screening and background investigation due to change in risk designation
Within 60 business days after completion of screening and background investigation due to change in risk designation
5.7
User Test Cases
Within five (5) business days of request
Within five (5) business days of request
Within five (5) business days of request
Within five (5) business days of request
Within five (5) business days of request
6.1.1
ICRAS Codebase, Database Tables, File Repository and Other Documentation
No Deliverable
No Deliverable
No Deliverable
No Deliverable
Within 30 days prior to the end of the contract

image1.png

File details come from the government source that posted it. Updated .