91003124R0017_SF1449 Continuation.pdf

Section 1: Services & Prices

1.1 Contract Line-Item Number Descriptions

The following table describes the available CLINs under the contract for Task Orders and their associated contract types.

Table 1. General CLIN Descriptions CLIN Title Description 0001 Transition In Comprehensive procedures for phasing in

Contractor performance to the level prescribed under the terms of this contract. Contractor shall prepare to assume full responsibility for all areas of operation in accordance with the terms and conditions of this contract to include receiving an Authority to Operate (ATO) on the FSA Network.

0002 Cyber Security Services

Cybersecurity costs including, but not limited to labor for cybersecurity requirements, software licensing, 3rd party vendor support, overhead, etc. required to support requirements for cybersecurity operations and maintenance. This CLIN does not include servicing operations or web/mobile.

0003 Hosting Fully managed application, web hosting, and data storage services including the general computing server, database server, web, and application server services. Includes standalone Web Service and App Service platform services, and Data Storage.

0004 Servicing Full operations as outlined in the Performance Work Statement (PWS) minus cybersecurity.

0005 Transition Out Comprehensive procedures for phasing out Contractor performance to affect a smooth and orderly transfer of contract responsibility to a successor including, at a minimum, employee notification; retention of key personnel; turnover of work-in-progress; inventories, and Government property; removal of Contractor property; data and information transfer; and any other actions required to ensure continuity of operations.

0006 Change Requests A CR may take the form of either a contract modification or other written documentation of the change. All CRs will be issued by a numerical sequence and date (CR95, 11/20/13) and further provide indication of the CLIN that provides an appropriation to fund the CR. In the event a CR is issued via written communication other than an SF-30 contract modification, the Contracting

Officer will issue an SF-30 unilateral contract modification that summarizes all CR changes.

Change request modifications issued on a more frequent basis are solely at the discretion of the Contracting Officer. CR summary modifications are for administrative convenience and confer no extra rights to the parties to the contract.

1.2 CLIN Pricing and Rates

Each CLIN contains the prices and/or rates available to be applied with the Task Orders issued under the contract, for each year of the contract base period and all option periods. The Federal Acquisition Regulations (FAR) Clause 52.217-8 Option to Extend Services is applicable to all CLINS under the contract for the contract and all task orders.

In accordance with FAR clause 52.216-22, Indefinite Quantity, the maximum under this contract is $247,423,189.10. The minimum under this contract is the value of the initial task order issued against this contract.

CLIN pricing and rates proposed an/or set by negotiation shall be incorporated at award within this section on the next page.

1.3. First Task Order Award

The government will award the first task order with the award of the ID/IQ. The first task order will be issued to award CLIN 0001. No additional CLINs will be awarded on the first task order.

Section 2: Requirements

2.1. Performance Work Statement

1.1. Background / General Information

This Performance Work Statement (PWS) details requirements associated with Federal Perkins Loan servicing for a portfolio owned by the U.S. Department of Education (The Department or ED). Federal Student Aid (FSA) is an Office of the Department and oversees loan servicer administration of the ED-owned portfolio. The Government’s current Perkins Loan portfolio is serviced by Educational Computer Systems Inc. (ECSI), a subsidiary of Heartland Payment Systems. This contract is set to expire no later than January 31, 2025, with options through July 31, 2025.

The Federal Perkins Loan Program is one of three Title IV Campus Based Programs. Perkins loans were originally awarded by colleges and universities (also referred to in this document as schools or institutions). While Perkins loans are no longer being awarded, some institutions still service their existing Perkins portfolios. The authority to award new Perkins loans ended on September 30, 2017, and no additional disbursements were issued after June 30, 2018.

The Federal Perkins Loan Program also includes Federal Perkins Loans, National Direct Student Loans (NDSLs), and National Defense Student Loans (Defense Loans). No new Defense Loans were made after July 1, 1972, but approximately 2,700 are still in repayment.

The overall Federal Perkins Loan Portfolio is comprised of the school-held Perkins Loan Portfolio and the Department-held Perkins Loan Portfolio. Institutions or their servicers administer the Perkins Loan Portfolio (School Held). The Department’s Perkins Loan Portfolio (ED Held) comprises defaulted and non-defaulted Perkins loans. The Perkins Loan Portfolio contains approximately 1.6 million open loans (as of September 2024).

Institutions that have elected to stay in the Perkins program are required to report on their Perkins Fund and portfolio annually on the Fiscal Operations Report and Application to Participate (FISAP).

Institutions and servicers are required to report Perkins Loan activity, at the loan level, to the National Student Loan Data System (NSLDS). NSLDS is the national database of information about the Federal financial aid history of recipients of student financial assistance. As the central database for Title IV student financial aid since 1993, the NSLDS stores information about loans, grants, students, borrowers, lenders, guaranty agencies, institutions, and loan servicers. It provides an integrated view of Title IV loans and grants during all stages of their life cycle—from aid approval through disbursement, repayment, default, and closure. A Federal Perkins Loan is a low-interest loan (see rates below) for both undergraduate and graduate students that meet financial need criteria. Federal Perkins Loans were made through the school’s financial aid office. The school served as the lender, and the loan is made with the Perkins loan revolving funds.

Table 1 presents key information regarding a Federal Perkins Loan.

Table 2. Perkins Loan Information Maximum Loan Amount: Undergraduate Up to $5,500 a year (maximum of $27,500 as an undergraduate) Maximum Loan Amount: Graduate Graduate - up to $8,000 a year (maximum of

$60,000, including undergraduate loans) Interest Rate - Fixed at:

- 3% interest ended after 06/30/1981

- 4% interest was between 07/01/1981 –

09/30/1981

- 5% interest began 10/01/1981

Maximum Loan Length 20 years Frequency of Payments: Monthly. After a student graduates, leaves school, or drops below half-time enrollment, the student has a nine-month grace period before beginning repayment.

When an institution servicing its Perkins portfolio decides to end their participation in the program, the institution must transfer its Perkins loans to the Federal government by assigning the loans to the Department. Institutions may assign Perkins loans to the Department at any time. Loans assigned to the Department make up the ED-held Perkins loan portfolio.

Perkins Loan Assignment Process

Institutions may continue to hold and manage their existing Perkins portfolios in order to recoup as much of their capital investment made to their program until the eventual wind-down of the portfolio. If a school loses its eligibility to participate or chooses to no longer participate because it is no longer feasible for a school to continue in the program, the school must liquidate and close-out their program. As part of the liquidation and close-out process, a school must transfer all outstanding loans to the Department for servicing, or the institution reimburses the Department for the portion of the existing Perkins loan portfolio that cannot transfer to the Department through assignment. Institutions use the liquidation process by electronically notifying the Department’s Grants and Campus Based Division (GCBD) their intent to terminate participation in the Federal Perkins Loan Program. Several steps must occur in order to liquidate a Perkins Loan portfolio. Step-by-step guidance for this process is provided at Federal Perkins Loan Assignment and Liquidation Guide.

Institutions may assign Perkins loans and Total and Permanent Disability (TPD) discharges to the Department using the approved assignment form along with the required documentation and additional information (e.g., promissory note, judgments, payment history). Institutions send loans for assignment by mailing the assignment form and documents to the Federal Perkins Servicer; or alternatively by entering the assignment form data into an electronic online loan assignment system established and maintained by the Federal Perkins Loan Servicer, and then mailing the promissory note to the Federal Perkins Servicer. Loans submitted for assignment through the mail are entered into the electronic online loan assignment system by the Federal Perkins Loan Servicer. The Federal Perkins Loan Servicer ensures that ALL loans submitted for assignment, regardless of how they are submitted, are in the electronic online loan assignment system. The Federal Perkins Loan Servicer works directly with institutions to obtain information or documentation needed to facilitate acceptance of a loan for assignment.

The Federal Perkins Loan Servicer for the Department-held portfolio reviews the submitted assignment forms, promissory notes and documentation and makes a determination to accept or reject the loans. Loans that are accepted for assignment are added to the Federally held Perkins Loan Portfolio to be serviced by the Federal Perkins Loan Servicer. Assignments not accepted by ED are rejected back to the school. The Federal Perkins Servicer maintains detailed data in the electronic online loan assignment system on each loan submitted for assignment and makes data available to Department authorized users of the assignment system in useable on-demand reports.

The Federal Perkins Loan Servicer begins reporting on an assigned loan to NSLDS as soon as it has been accepted for assignment, essentially completing the transfer of the loan in the NSLDS system.

Guidance for Perkins Loan Assignments is provided at: Federal Perkins Loan Assignment and Liquidation Guide. The remainder of this section presents the impetus for changes in the Federal Perkins Loan Program, the potential impacts on the future of the Federal Perkins Loan Program and impacts on both the Federally held and institution held Perkins loan portfolio.

https://fsapartners.ed.gov/sites/default/files/attachments/2019-07/PerkinsAssignmentandLiquidationGuide.pdf https://fsapartners.ed.gov/sites/default/files/attachments/2019-07/PerkinsAssignmentandLiquidationGuide.pdf https://fsapartners.ed.gov/sites/default/files/attachments/2019-07/PerkinsAssignmentandLiquidationGuide.pdf https://fsapartners.ed.gov/sites/default/files/attachments/2019-07/PerkinsAssignmentandLiquidationGuide.pdf

There are internal and external factors that may shape the future landscape of the Federal Perkins Loan Program and Perkins Portfolio including:

• The Office of Management and Budget (OMB)

• The President’s Management agenda

• Federal Student Aid’s 5-year strategic plan

Key factors about to the Federal Perkins Loan Program:

1. The Perkin’s Loan program is slowly winding its way down but may take years until loans are repaid or otherwise fully retired. Perkins Loans typically have a 10-year repayment plan but can extend to 20 years with documented hardship. However, borrowers can extend the time in repayment via forbearance or deferment.

Example:

-The authority allowing institutions to make new loans ended in 2017.

-The borrower borrowed a Perkins loan in September 2016.

-The borrower graduated in December 2017; they received 9 months grace (ending September 30, 2018).

-COVID forbearance started March 2020 and ended August 31, 2023 (42 months)

-Although the 10-year repayment period would normally end approximately September 30, 2028, because there was 42 months of COVID forbearance, the repayment period would end April 1, 2032.

2. FRESH Start: Fresh Start is a one-time temporary program from the Department that offers special benefits for borrowers with defaulted federal student loans. Upon request/application, borrowers can request to have their defaulted loan transferred back to a non-default servicer. Loans are put in a repayment status and the default tradeline deleted with the credit reporting agencies.

3. Elimination of institutions as servicer:

Although institutions are allowed to continue to service their current portfolio, many institutions will likely liquidate their Perkins portfolio to the Department. The servicer of the Perkins Loan Portfolio (ED held) must accommodate the assignment of a significant percentage of Perkins loans through the liquidation process.

With the increase in loan volume expected for the Perkins Loan Portfolio (ED held), a servicer will need to focus on default aversion through changing macroeconomic environments. Although the Department has unique legal tools to recover students’ federal obligations (e.g., default reduction assistance, wage garnishment, treasury offset) there is room to further decrease the cost of the federal student aid programs to the American taxpayer without affecting their effectiveness.

The servicer of the Federal Perkins Loan Portfolio (ED held) will be required to service, monitor, and report on loans throughout the financial aid lifecycle (e.g., repayment, cancellation, closure).

Per FISAP ending August 2024 School Held borrowers – approximately 894,000.

Outstanding principal balance (School held) $1,327,026,837

4. Total and Permanent Disability (TPD) Changes The Department is in the process of changing how TPD is processed. Currently, loans being discharged are transferred to a designated TPD servicer for processing. However, soon the holder of the loan will not transfer the loan. They will discharge the loan in house.

5. After the On Ramp process is completed, 9/30/24, borrowers will once again begin to age into default and transfer to Debt Management and Collections System (DMCS), the Department’s default servicer. Approximately, 90% of the loans being assigned to the Department are defaulted. DMCS will service the defaulted loans. The Perkins Loan servicer will be a pass through to DMCS. They will accept the assignments and then transfer the loan to DMCS.

Federal Student Aid Customer Contact Information

This section presents the contact information for the Contracting Officer (CO), Contract Specialist (CS), and the Contract Officer Representative (COR).

Table 3. FSA Contacts Name Role Email Kim Kilpatrick CO Kimberly.Kilpatrick@ed.gov Kimberly Hampel CS Kimberly.Hampel@ed.gov Carmen Hines COR Carmen.Hines@ed.gov

1.2. Scope

The Department developed this Performance Work Statement to acquire a Servicer that, at a high-level, can perform the following activities.

Develop a security compliant system to allow the electronic submission, processing and validation of loan assignment data (single loan and multiple loan batches) from institutions and/or third party Contractors to support the requirements and design approved by the Department; and which will allow the recording and storing of all loan assignment activities for each loan including the upload and storage of loan documents; and which will permit querying and report creation of all loan assignment data.

Receive and process the intake of a varying volume of submissions of loans for assignment to include electronically submitted as well as mailed assignment submissions.

Process each loan submitted for assignment by determining if the loan is supported adequately by the documents provided and ensuring that the documentation is acceptable for establishing the validity of the debt.

Perform the research and the outreach to institutions in cases in which additional information or documentation is needed to facilitate the assignment of a loan(s); notify institutions regarding accept or reject decisions.

Serve as a point of contact for institutions with questions regarding loan assignability, required documentation, status of assignment submissions, etc.

Record in the electronic system all loan assignment activities for all loans submitted, grouping loan submissions by school as well as individually in the system, and providing total access to all data to the Department authorized users, as well as providing on-demand real-time reports in the system.

Submit loan data to NSLDS to report on Perkins loans that have been accepted for assignment in the same week that the loans were accepted; review error reports and resolve discrepancies preventing loans from being reported to NSLDS within 1 week of the initial submission (to include contacting a school if a loan record needs to be corrected by the school to facilitate successful reporting).

Provide the Department with monthly (and ad hoc) reports to include but not be limited to the breakdown and details of the monthly volume of incoming assignments, status of assignment submissions, carryover, and rejected loans.

• Leverage its existing servicing solution (e.g., Commercial Off The Shelf (COTS) product, a modified COTS product, internally developed system) to:

o Service the Federal Perkins Loan Portfolio (Federally held) in its current state.

o Maintain images of documents associated with loans and borrowers provided by institutions, other servicers, or previous servicer.

o Send appropriate correspondence to borrowers.

o Develop client reports.

o Report to the Department systems NSLDS and FMS o Transfer loans to the Total and Permanent Disability Servicer and the Default

Servicer as appropriate.

o Support consolidation of Perkins loans into Direct Loans

• Meet the Department’s needs in a dynamic environment (i.e., scalability to meet an increase in the Federal Perkins Loan Portfolio (Federally held) to the entirety of the Federal Perkins Loan Portfolio)

• Provide superior customer service.

o Call-center support o Borrower self-service capabilities through servicing website o Documents in alternative format (Braille, Large print, Audio CD, and Data CD upon the request of the borrower)

• Implement proven default aversion measures to improve the Federal Perkins Loan

Portfolio (Federally held)

• The Servicer shall collaborate with Educational Computer Systems Inc. (ECSI) to plan transition activities for knowledge sharing and transferring of loans (e.g., inter-system testing, scheduling loan transfers, scheduling image transfers, transferring loans, transferring images).

1.3. Specific Requirements

FSA 45-1 SPECIAL CONTRACT REQUIREMENTS FOR GOVERNMENT FURNISHED

PROPERTY – TWO FACTOR AUTHENTICATION TOKENS (TFA) (JUN 2015)

In addition to the requirements of FAR 52.245-1(b) - Government Property, the Contractor shall:

a) Ensure the Contractor’s Government Property Manager or designee shall sign a distribution letter provide by the Contracting Officer upon receipt of Government Property.

b) Comply with instructions on how to register the tokens using the Federal Student Aid Two Factor Authentication Token for FSA User Handout distributed with the tokens.

c) Seek immediate assistance with any challenges encountered with FSA CITRIX and TFA and immediately report any security or other incidents by telephone or email to the helpdesk at: 1- 877-603-4188 or ed.customer.service@ed.gov and.

d) Provide a Property Management Plan to the Contracting Officer within 5 business days of receipt of the Government Furnished Property. Among other FAR 52.245-1(b) requirements, the Property Management Plan must contain at minimum the following:

▪ Description on how the Contractor will establish and maintain an auditable record of the token assignment to its employees by individual name and token Serial Number (AVT+9 digits).

▪ Method by which the Contractor shall ensure that the serial number label on the back of each token remains legible and secure to the device.

▪ Security and management process for the physical devices as well as changes in assignment.

e) Upon written notification from the Contracting Officer, the Contractor shall affirm its understanding and compliance with the Government’s requirement for quarterly re-certification of user access and token activation. In the event of any reported security breach, the Government shall immediately disable or deactivate Contractor access to its network without prior notice.

f) Soft Tokens can be used instead of hard tokens. The soft token is an app that runs on the user’s mobile device. After downloading and registering the free Symantec VIP Access app on a phone or tablet, a user simply opens the app, and a One-Time Password (OTP) is automatically generated similar to a hard token. Use of a soft token is optional, however users who have a compatible mobile device are encouraged to transition to a soft token. There is no requirement to maintain property records on soft tokens.

g) Contact Information. For additional information on TFA or the use of a soft token, contact the TFA Support Center at 800/330-5947, option 2 (TDD/TTY 800/511-5806) or by email at TFASupport@ed.gov.

1.4 Performance Requirements

This is a high-level breakout of performance requirements. See the full requirements listing for detailed deliverables, due dates, and performance criteria.

Table 4. Performance Requirements

Number Performance Event

Specific Performance Requirement

Performance Timeline

Performance Metric

1. Default aversion/ management

The Contractor shall develop and implement a detailed plan to minimize defaults from occurring.

The solution shall identify delinquent loans and initiate due diligence.

The solution shall identify skip accounts and schedule skip activities. (Bad addresses, emails and phone numbers).

The solution shall continue and monitor skip trace cycle.

The solution shall identify defaulted loans and transfer to

DMCS.

Servicer implements effective default aversion tools to prevent delinquent borrowers from going into default.

Defaulted loans are transferred to

DMCS.

Develop and adhere to a default aversion plan that at a minimum includes interactions with borrowers (e.g., letters, calls), frequency, at the various stages of delinquency.

2. Correspondence The solution shall generate correspondence to borrowers, based on various factors, including, but not limited to:

• Account status

• Borrower request

• Delinquency condition

• Forbearance/Deferment ending notice.

• Documentation received (e.g., request for deferment or forbearance)

• Change in loan terms.

• Cancellation request status

Approved correspondence is sent to borrowers timely based on the occurrence of specific events.

Correspondence is sent to borrowers based on business rules applicable to the event with no needed corrections.

Specific Performance Requirement

Performance Timeline

Performance Metric

3. Customer service

The solution shall utilize a call center to handle customer inquiries to include phone, chat, text, and email.

The Contractor shall remain open when Federal Student Aid is in operation.

The Contractor shall develop an escalation procedure for handling customer inquiries.

The Contractor shall develop and implement a training plan for call center representatives.

The Contractor shall provide daily and monthly customer service reports that include, but not limited to, the following information:

• Number of calls offered.

• Number of calls answered.

• Number of calls abandoned.

• Average speed of answer

• Number of calls answered through the IVR (Interactive Voice Response)

FSA will develop, with input from the contractor, a scorecard for evaluating customer interactions and will update that scorecard periodically.

Maintain a customer satisfaction rating of at least 70% or higher as determined by FSA’s Customer Satisfaction.

Maintain a monthly abandon rate of 8% or lower through 3/31/2025 and 4% or lower thereafter.

Ensure 95% of customer interactions (i.e., inbound and outbound calls, chats, emails) pass an interaction quality monitoring review as measured by FSA.

Specific Performance Requirement

Performance Timeline

Performance Metric

4. Customer self-service

The solution shall provide borrower self-service options as part of the borrower website. At a minimum, the borrower shall be able to access and upload documents for the following services:

• Account information

• Federal Perkins Loan Information

• Deferments

• Cancellations

• Forbearance

• Payment Options

• Regulatory Information

• Link to consolidation

Borrowers are aware of and use the self-service options available on the borrower site to perform functions and locate answers to their questions.

Provided a web solution accessible to borrowers and ensure borrowers have access to self-service mechanisms.

5. System availability

The solution shall provide, at a minimum, 99% availability (not including scheduled maintenance outages).

99% availability of the servicing system for borrowers and the client.

99% availability (not including scheduled maintenance outages).

6. Client reports The solution shall provide canned, online reports.

Appendix A provides the current reports that are generated for the Department.

The solution shall provide the capability for the Department to develop ad hoc reports.

The solution shall provide online reports that are downloadable in pdf and excel file formats.

Canned reports are available online and downloadable in pdf and excel format.

Canned reports are saved in a library as new reports become available.

Ad hoc reports are easily created by the Department’s staff.

Schedule developed for the release of each canned report with no needed corrections.

Specific Performance Requirement

Performance Timeline

Performance Metric

7. NSLDS

reporting

The solution shall report all Perkins loans and loan activity to NSLDS in accordance with the ED Servicer data provider instructions. Appendix C provides the ED Servicer data provider instructions and other NSLDS requirements.

Timely reporting to NSLDS of Perkins loans and loan activity per ED Servicer data provider instructions.

Errors are corrected within 1 week.

Perkins loans and loan activity are submitted to NSLDS with a 98% or higher edit passage rate.

Errors are resolved with NSLDS within 1 week.

8. Financial reporting

The solution shall report financials to the Department’s Financial Management System (FMS), monthly, including but not limited to:

• Servicer system trial balance by fund is compared to the FMS trial balance each month-end.

• Principal and interest from the servicing system is compared to FMS and balanced monthly.

• Servicer system compares unapplied cash in servicer system to FMS unapplied cash balances.

• Servicer system verifies the Department’s cash collections and posting by doing monthly bank reconciliations

Financial reports sent to FMS timely and accurately.

Errors are corrected within 1 week.

Financial reports sent to FMS timely and accurately. Errors are resolved within 1 week.

Specific Performance Requirement

Performance Timeline

Performance Metric

9. Reconciliation The solution shall follow the Department’s reconciliation process for:

• Unprocessable and misdirected payments

• General ledger summary file reconciliations

• Ca$hLink II/TRS to GL summary file reconciliations

• Reconciliation of applied/unapplied cash.

• Refund file reconciliation

• Monthly submissions to the Department

Reconciliation reports are sent to the Department timely and accurately.

Errors are corrected within 1 week.

Reconciliation reports are sent to the Department timely and accurately.

Errors are resolved within 1 week.

10. Assignments

Assignment submissions received by the servicer in the mail are entered into the electronic assignment system.

Each loan received for assignment is then in the electronic assignment system and all activities, actions taken, and current status of the assignment process for each is recorded and updated.

Assignment submissions are received and processed expediently.

Institutions are able to track progress of assignments in the electronic assignment system.

Department users are able to view/download all assignment submissions and statuses by school and/or by individual loan/borrower.

Loans submitted for assignment are entered into the electronic system no later than one week after receipt.

Loans in the electronic system are updated in real-time as accept/reject decisions are made, or other actions or changes occur.

Specific Performance Requirement

Performance Timeline

Performance Metric

11. Assignments The servicer shall work with institutions in order to receive, review, accept/reject assigned Perkins loan(s).

Required documentation is received and determination of acceptance can be made;

or loan is rejected because school does not have required or alternate documentation to assign loan.

Work with institutions to obtain the appropriate loan data for assignment.

Five attempts within thirty business days will be made to contact the school to obtain the needed documentation or information. Loan will then be rejected back to the school no later than thirty days after first attempt if required documents and/or information is not received.

Make determinations of acceptance/rejection based on established guidelines.

Completion timeframe is within 30 business days.

12 Treasury’s Collection Information Repository (CIR)

The Servicer shall establish an interface with the Treasury's Collection Information Repository (CIR) for the receipt of Treasury Lockbox ECP (electronic check processing) payments file.

2 weeks prior Go Live

Establish a successful interface with CIR to receive and process the lockbox return files through the XML file format specified by CIR

Specific Performance Requirement

Performance Timeline

Performance Metric

13 Annual Financial Statement Audit

The Servicer shall provide prepared-by-client (PBC) requests development and PBC process improvement support

Annually Delivered timely and free of errors

14 Monitoring Practices

The Servicer shall establish FSA approved monitoring practices and standards. The Servicer shall review employee monitoring results (internal and completed by FSA/others) and incorporate those results into updated/improved internal control and monitoring activities

No later than 10 business days from the end of each FY quarter

Delivered timely and free from errors.

1.5. FSA Minimum IT Requirements for Information Systems

1.5.1. FSA System Development Lifecycle (SDLC)

The Contractor shall comply with the Federal Student Aid System Development Lifecycle (FSA- SDLC), currently named the Lifecycle Management Methodology (LMM), during the term of this contract.

https://studentaid.gov/about/contracting-info/it-standards

1.5.1.1.FSA Software Development Approach For software development activities: software development approach must result in a low-risk and compliant development process. Any proposed solution must leverage technologies currently approved by FSA. The solution should use automation to accelerate testing. A large portion of FSA’s existing DevSecOps pipelines is in the Amazon Web Service (AWS) environment.

Any proposed solution shall utilize the products approved in FSA’s Technology Standards and Product Guide (TSPG), (Attachment 02) 1.5.1.2.FSA Software Platform For system and software platform: Any proposed solution must be developed with portability and severability in mind. This is to accommodate an eventual migration to a unified cloud platform that Federal Student Aid is currently visioning and building. As an interim strategy, it is preferred that the solution be positioned as an application tenant in one of two existing platforms in use by Federal Student Aid. If the solution is positioned in another platform (not one of the existing platforms) it is expected that the solution will be portable to the future unified cloud platform that Federal Student Aid is currently visioning and building. All the application related core functionalities should be derived from the platform. These functions include but are not limited to:

Logging, monitoring, security scanning, Identify and Access Management (IDAM), Security Information and Event Management (SIEM), version Control, CI/CD pipeline, build management, Artifact and Configuration management, test automation, telecom, VPN and firewalls.

1.5.1.3.FSA Cloud Architecture Applications shall be portable and severable to FSA’s targeted cloud platform. If the vendor intends to stand up their own cloud solution platform, then the vendor must support a multi-tenant-multi-vendor posture on their platform; if they do not, then they will need to host their application tenant within the most suitable existing platform (e.g., NGDC cloud, FSA Cloud).

1.5.2. Collaboration Requirement

In carrying out the scope of work under this contract, the Contractor shall collaborate and share technical information with FSA and other Contractor support staff in the holistic delivery of solutions, services, and results to FSA. This collaboration may be required in specific situations at the direction of the Contracting Officer or as may be delegated to the Contracting Officer’s Representative.

1.5.3. Transition Support

Transition Support Instructions https://studentaid.gov/about/contracting-info/it-standards

To ensure a smooth transition, and support of such continuity of service requirements as may be stipulated in the contract; the contractor shall submit a Phase-In Plan as a part of its technical proposal. This plan will be used as a basis of negotiation by the successor contractor and transition with the incumbent Contractor. The government will provide existing contract phase-out plans, if available, to the proposing contractors to assist their efforts.

The Contractor shall also establish and implement plans for an orderly phase-out of the contracted operations at the termination of this Contract. The Contractor shall submit a Phase-out Plan to the CO for evaluation and approval six-months after contract start. The Contractor's phase-out procedures shall not disrupt or adversely impact the day-to-day conduct of Government business. The Contractor shall maintain the plan as contract changes are made and provide the CO with the copies of changes and revisions for review and approval prior to implementation. The Contractor will use this plan to ensure the smooth transition of services to a successor Contractor in accordance with 52.237-3, Continuity of Services.

The Contractor shall provide a Transition Management Plan within 1 month of contract award.

The Transition Management Plan should describe the procedures for changing over usage from the replaced system (if any) to the new system. Procedures described must address handover support arrangements, handover schedule, roles & responsibilities, training, stakeholder management, migration strategy, documentation turnover, acceptance, implementation and transition acceptance. It should document a brief description of the functionality of the project as a whole and, for multi-release projects, the current project release. It should also document the objectives of the plan and list the transition related principles, constraints and assumptions.

The plan should describe the enterprise level transition strategy for this release of the project. It must define current and future state, then perform a gap analysis to recognize and confirm gaps, design transition approaches/initiatives, identify major risks and issues, and develop risk mitigation strategies. It must define dependencies, stakeholders, who is developing the solution, and roles and responsibilities post transition. Staffing needs, training needs, and inventory assets and documents to be transitioned must be documented. In addition, the Contractor shall conduct a transition readiness assessment.

1.5.3.1. Transition Support (Phase-In)

The Contractor shall develop comprehensive procedures for phasing in Contractor performance to the level prescribed and within the time allowed under the terms of this contract.

The period between Contract award date and Contract start date will constitute the phase-in period. During the phase-in period, the Contractor shall prepare to assume full responsibility for all areas of operation in accordance with the terms and conditions of this contract. The Contractor shall take all actions necessary for a smooth transition of the contracted operations.

The Contractor shall propose their phase-in period, not to exceed six months. The Government will make all facilities and equipment accessible to the Contractor during the phase-in period.

During the last 60 days of the phase-in period, the Contractor's management personnel will be permitted to observe any on-going operations, as approved by the CO.

During the phase-in period, the vendor will work with FSA to develop a plan to achieve these requirements in no more than 6 months. Phase In tasks include but are not limited to:

• Establish a Contractor’s Project Management Office to coordinate phase-in tasks and to be the single point of contact for the Government during the phase-in.

• Recruit and hire necessary personnel.

• Obtain all required certifications and clearances, including personnel security clearances. For access to any Federal Student Aid facility, system, and/or data, all Contractor personnel shall be required to obtain the necessary security clearance in accordance with the U.S. Department of Education personnel security policy and Federal Student Aid IT Security & Privacy Policy.

• Participate in development of joint inventories and sign for Government furnished property/equipment/information.

• Develop and submit any required deliverables as outline in the PWS and Requirements package.

• Attend post-award meetings as required.

• Accomplish necessary training to support the operations and maintenance functions.

• Complete an approved data mapping strategy to accept data from the outgoing

Contractor’s system to your system.

• Work with FSA and the current Contractor to develop a loan transfer plan to account for all loans within the portfolio.

1.5.3.2. Transition Support (Phase-Out)

The Contractor shall develop a Phase-Out Plan to affect a smooth and orderly transfer of contract responsibility to a successor. The plan shall be developed 6 months prior to the end of the contract and fully describe how the Contractor shall, at a minimum, approach the following issues: employee notification; retention of key personnel; turn-over of work-in-progress, inventories, and Government property; removal of Contractor property; data and information transfer; and any other actions required to ensure continuity of operations.

The Contractor’s Phase-Out Plan shall, at a minimum, require that the incumbent and the Government conduct an inventory before the conduct of a joint inventory between the incumbent and the successor Contractor. The Plan shall, at a minimum, also include reconciliation of all property accounts, requisitions, and work-in-progress; turn-in of excess property; Contractor work areas’ clean-up; plan for training successor Contractor, specialized equipment, utilities systems, and ongoing work that the successor would be required to complete; and security debriefings in accordance with FSA security procedures for incumbent personnel holding security clearances.

For a period of sixty (60) calendar days, starting anywhere from 60 days prior to the expiration of this contract to 90 days after the contract expires (as directed by the Contracting Officer in accordance with 52.237-3, Continuity of Services, an observation period shall occur, at which time management personnel of the incoming workforce may observe operations and performance methods of the incumbent Contractor. This will allow for orderly turnover of facilities, equipment, and records and will help to ensure continuity of service. The Contractor shall not defer any requirements for the purpose of avoiding responsibility or of transferring such responsibility to the succeeding Contractor. The Contractor shall fully cooperate with the succeeding Contractor and the Government so as not to interfere with their work or duties.

1.5.4. Personally Identifiable Information

The Contractor shall secure, protect, and not release any data containing Personally Identifiable Information (PII) regardless of form or media, consistent with FAR clause 52.227-17.

1.5.5. Intellectual Property

All deliverables not containing PII shall be delivered with unlimited rights, as defined by FAR clause 52.227-14.

1.5.6. Software Licensing

The Contractor must provide a listing of all required COTS software to include product descriptions and quantities with itemized unit and extended costs for each product. The Contractor will purchase and hold the licenses (turning the licenses over to FSA at the end of the period of performance), If FSA procures or funds any software through the Contractor, visibility and access to license oversight, to include real-time distribution (even if being distributed by the Contractor) and usage, must be provided to FSA at time of procurement.

It is not anticipated that there will be a need for FSA distributed software. However, should, any COTS software not procured through the Contractor be needed, software will be distributed by FSA and the change negotiated with the Contractor, as needed. Administrative and support access will be shared with appointed Contractors for software management, maintenance, support, deployment and/or distribution so long as FSA retains required visibility.

1.5.7. FSA Branding

FSA requires that both public-facing and internal products follow the FSA Brand Style Guide and FSA Design System. The Contractor shall comply with the FSA brand requirements included in the FSA Brand Guidelines (Attachment 03) when creating, designing, developing, writing, updating, and maintaining both information technology products and document products.

1. FSA Branding requirements apply to all websites and mobile apps, all configured screens within information systems, all mobile application screens, all FSA social media, and all customer-facing documentation/content that is intended for use by students, parents, borrowers, or schools.

2. Documentation that is purely internal in nature for use by FSA staff and Contractors, such as project management documentation and documentation used to manage information systems, shall not be subject to the branding requirements. Information technology that is purely back-end in nature (the user base consists of system administrators or only IT-personnel) shall not be subject to the branding requirements.

3. Contractors shall submit for approval brand and content layouts or plans, appropriate to the product they are producing, prior to work on branding elements of the product. FSA may require changes to conform with the FSA Brand Style Guide and Design System (Attachment 03). FSA will work with the Contractor to provide additional design elements when needed. Contractors must receive approval of the proposed products before taking action.

a. Screen mock-ups showing planned FSA Branding shall be submitted for websites, configured screens within information systems, mobile applications, and social media.

b. Templates and layouts shall be submitted for customer-facing documentation.

4. FSA may modify or update the FSA brand style guide and design system standards (Attachment 03) at any time. When such modifications occur, the Contractor shall incorporate relevant updates into the next major product release or at another time as agreed by FSA.

5. The Contractor may request a waiver from specific elements of the FSA Brand Style Guide and Design System (Attachment 03). FSA will consider such requests and may also work with the Contractor to achieve an alternative solution to the specific branding element(s) at issue in the waiver request.

6. The Contractor shall, after creating new common components or making modifications to existing components within the FSA Design System that could be useful in other projects, contribute the design and code for those components to FSA for inclusion in future design system versions.

7. A representative for each Contractor actively developing an information system or website shall participate in quarterly brand working group meetings while the development cycle is ongoing. The Contractor representative shall collaborate and discuss the current and future state of the FSA brand standards and design system, and voice ongoing concerns, needs, and solutioning.

1.5.8. Contractor Support of Technology Refreshment

As part of its standard technology refreshment program, FSA requires regularly-scheduled and periodic upgrades of the underlying infrastructure, support software, and enabling frameworks to (at minimum) N-1 versions (where N is the latest version and N-1 is the second latest version).

SaaS, PaaS, and/or IaaS Solutions: The Contractor performing integration services for FSA in connection with FISMA-approved cloud computing services (SaaS, PaaS, IaaS) shall ensure the infrastructure, support software, and enabling components and frameworks are maintained to (at minimum) N-1 versions as part of a standard technology refreshment program.

Infrastructure and COTS Software: The Contractor shall support refreshment activities, including infrastructure and software upgrades and patches led by FSA’s infrastructure and middleware Contractors. As needed, the Contractor shall regularly support planning and scheduling, impact analysis, changes to the application, and testing.

Applications and Enabling Components and Frameworks: The Contractor shall ensure that functionality and application design are optimized; maintenance is cost efficient; the enabling technology remains under support by third party Contractors (e.g. IBM, Oracle, or Microsoft); the application code and its underlying frameworks are maintained at the N-1 or N version. Refer to the Federal Student Aid Technology Standards and Products Guide for additional information.

FSA’s Technology Standards and Product Guide (TSPG) (Attachment 02).

1.5.9. Personnel Security Requirements

The Contractor shall comply with Department of Education personnel security requirements and policies as set forth below:

• Department of Education Contractor Vetting Security Requirements. Please refer to Internet-published document linked below:

https://www2.ed.gov/fund/contract/about/bsp.html

• Positions on this contract that perform the duties of system administrator, database administrator, software/code developer, IT operations support manager, system technicians with administrative privileges, software test manager, quality assurance manager, configuration manager, system analyst, security manager, security analyst, any position with access to vulnerability scan/penetration testing results, customer services manager, project manager, program manager, policy officer, program executive, and any IT-related positions designated as key personnel are required to meet requirements for High Risk/Public Trust Contractor Positions, as described in the Department of Education Contractor Vetting Security Requirements.

1.5.10. Cybersecurity Requirements

The Contractor shall comply with Department of Education cybersecurity and privacy requirements in the following document:

Department of Education Security and Privacy Requirements for IT Procurements. Please refer to Internet-published document link: https://www2.ed.gov/fund/contract/about/bsp.html

Any solution making use of cloud services must use FedRAMP certified cloud packages and be approved by the Department of Education for use.

The following subsections describe FSA Cybersecurity requirements that supplement the Department of Education Security and Privacy Requirements for IT Procurements. In the event of any conflicting requirements, the Department of Education Security and Privacy Requirements for IT Procurements shall prevail.

The Contractor is advised to thoroughly review Department of Education and FSA cybersecurity requirements with a focus on obtaining and maintaining an Authority to Operate (ATO) for the information system that is supported by this contract. Obtaining and maintaining a ATO for a federal information system is a significant responsibility accepted by the Contractor in performing the work under this contract. Refer to the ATO 101 slide presentation for a brief, high-level overview of the process. This slide presentation is available at the IT Standards Library: https://studentaid.gov/about/contracting-info/it-standards .In addition, please see the Initial ATO Timeline Actions (Attachment 12).

1.5.10.1.FSA General Cybersecurity Requirements

• The Contractor shall ensure the solution is defined, designed, developed, and maintained in a manner such that it implements the cybersecurity requirements and standards. FSA and the Department of Education have implemented a risk-based approach and measurement methodology for each system and the information system’s cybersecurity performance under FSA contracts. The Contractor shall ensure that the FSA system and associated technologies meets all requirements for cybersecurity including but not limited to the cybersecurity scorecard.

• The Contractor shall ensure that they fully participate, and enter in the appropriate agreements, with the FSA and Department of Homeland Security (DHS) Cyber Hygiene programs.

• The Contractor shall designate a Security Manager, who shall serve as a primary contact point regarding security related issues. The Security Manager shall work with the designated Information System Security Officer (ISSO) to ensure that the information system remains secure, vulnerabilities are addressed, and that all required security documentation and reporting is maintained.

• The Contractor shall allow FSA access to FSA information including data…