Attachment G - General Activities SOO (11).docx

Task 11 (Applicable to all Contracts)

Statement of Objectives General Activities

National Assessment of Educational Progress

(NAEP)

2024-2029

11. General Activities This section contains activities that are required of each contractor covered by this performance work statement. NCES views this procurement period, 2024-2029, as the time for developing and implementing a solid foundation for meeting the challenges outlined in the Procurement Overview as well as new challenges that will arise over the next five years. The Coalition of Teams shall work individually and collectively to support NCES in continuing the transition from a paper-and-pencil assessment to a fully technology-based assessment. Such fundamental changes in how the program operates will require exceptional leadership from every contractor and strong commitments to understanding the environmental and policy pressures that NAEP will encounter.

The four types of activities grouped under this section include:

11.1 Project Oversight and Management

11.2 Coordination with other NAEP Contractors

11.3 Providing Support for NCES

11.4 Transfer of Materials

These activities are mostly administrative, reflect regular documentation of requirements and progress, and will help to facilitate the flow of work across contractors. Meetings between contractor personnel and NCES described in this chapter and elsewhere in the performance work statement shall be held in Washington, DC metropolitan area or as required by NCES.

11.1 Project Oversight and Management

11.1.1 Project Initiation Meetings

Each individual contractor shall attend two Project Initiation meetings within the first two (2) weeks after the contract start date. The first meeting (one day) will be at Department of Education Washington, DC offices or virtual between key personnel from the individual contractors and the Contracts Officer (CO), the Contracts Specialist (CS), and the Contracting Officers Representative (COR). The purpose of this meeting is to review the tasks to be carried out and to discuss any issues related to the conduct of the work. The contractor shall propose the agenda for the meeting that identifies the issues for discussion requiring resolution. After the meeting, each contractor shall submit a summary that specifies issues discussed at the meeting and presents action plans for agreed-upon action items. Once approved by the COR, this summary document shall constitute the commitments agreed to by the contractor and NCES.

The second meeting (two days), held virtually, will be with the key staff of all NAEP Coalition contractors, the CO(s), the CS(s), NAEP COR(s), and other NCES staff. The purpose of this meeting is to review and refine plans for collaboration and the flow of work across contractors. Discussions shall include, among other things, communication systems, the integrated management system, quality assurance, and issues that each contractor has identified as potentially problematic. Each contractor shall provide proposed agenda items. In consultation with NCES, the Program Operations and Coordination (POC) contractor will consolidate the proposed agenda items into a single agenda. A summary document of the agreed upon issues and actions shall be submitted to NCES. Once approved by the CORs, this summary document shall constitute the commitments agreed to by the contractor and NCES.

11.1.2 NAEP Integrated Management System (IMS)

The complexity of NAEP requires a management tool so that NCES and its contractors have access to both internal and external information that can be used to make operational decisions, to monitor the status of work on the assessments, and to be able to update progress daily. To make decisions, relevant information needs to be documented, up-to-date, and easily accessible. To that end, the NCES will use the existing Integrated Management System (IMS) to be maintained by the Web/Technology Development, Operations and Maintenance (WDOMS) contractor. Each Coalition contractor shall maintain modules and components relevant to their area of expertise and contract.

Each contractor shall provide a master schedule for completion of the activities specified for their respective contracts including key milestones, deliverables, flowcharts, and timelines. Handoffs to be received from and delivered to other Coalition contractors shall be identified with timelines for the transmissions.

Examples of information currently maintained on the IMS can be viewed in the documentation accompanying the SOOs.

11.1.3 Administrative Reports

Monthly Status Reports. Each contractor shall provide a monthly update on the status of the project citing concerns, proposed action plans that address the concerns, budget over- or under-runs, and requirements for assistance from NCES. The report shall include a description of the past month’s completed activities and the current month’s planned activities, and an updated staff-loading chart. These electronic reports shall be posted on the IMS system no later than the 10th day of each month.

Monthly Cost Reports. In addition, NCES requires detailed expenditure/cost information (provided electronically in spreadsheet format) from its NAEP Coalition contractors that will make it possible to:

· Monitor and analyze costs by tasks across contractors

· Make cost projections in response to questions from Congress, the National Assessment Governing Board, and others, especially regarding potential future assessments, and

· Use such data to assess aspects of contract performance.

NAEP utilizes a Contract Monitoring Tool (CMT) for reviewing budget, actual costs, schedule, and content-area-related information as well as for financial planning and report submission. The CMT provides transparency and EVM actionable data for each contract. Contractor(s) shall provide data in a specific format and in the detail as follows:

· Contractors shall provide budget cost and budget schedule data no later than June 1st of each contract year. This will serve as a baseline for the year.

· Contractors shall provide actual cost and schedule data monthly, usually by the 10th of each month.

· The following types of data are required:

· Budget Data—provide, in whole dollars, by month, at the 3rd task level (n.n.n). These data must be provided by September 1st of each contract year. Depending on the type of contract negotiated (e.g., fixed-price or cost-reimbursement) the data may need to include all costs (labor categories, direct costs, overhead costs, G&A, and fee).

· Budget Content Area Data—provide all content area-related costs. A mapping of subject costs, by subject is acceptable and must be related to tasks as reported in Budget Data above.

· Schedule Data—provide cumulative and monthly Schedule Performance Index (SPI) by subject and a list of deliverables, activities, and handoffs used to calculate the SPI.

· Actual Costs—provide actual monthly costs by the 10th of each month, for the prior month’s actual costs. Depending on the type of contract negotiated the data may need to include all costs (labor categories, direct costs, overhead costs, G&A, and fee).

· Actual Costs by Subject—provide actual monthly costs (Actual Cost of Work Performed (ACWP)) by subject no later than the 10th of each month, for the prior month’s actual costs.

· The cost information may be submitted as a flat file transfer, entered manually into the data entry spreadsheet, or as an Excel upload/download.

· For specific data submission requirements see appendix 9.1 NCES will train each contractor on the use of CMT and provide each contractor with access to their specific data and/or reports. The following provides samples of acceptable data formats.

For cost-reimbursement tasks, the primary input into this cost system will be the contractor’s incurred costs for a given month, exported as “Actual Hours, Actual Dollars, and Current Month.” The process shall be as outlined in Table 9.1.

Further, each contractor shall submit monthly EXCEL workbook monthly using the templates included as part of the procurement package.

Table 11.1. Cost Reporting System Requirements for Cost Reimbursable Tasks Prepare monthly report of “Actual Dollars, Current Month,” to provide data on incurred costs, by contract task, for at least the cost categories specified in Exhibit 9-1 in the workbook template.

Upload this information into the NCES cost information system. The system will then generate additional tables to be completed, as shown in the EXCEL workbook, and described in steps 3 through 6 below.

Complete the percentage allocation (or actual cost distribution) for each direct cost category across the subcomponents of the first reporting component, “type of assessment” (Exhibit 9-4). Note that at a minimum, contractors shall provide an estimated percentage distribution. Contractors may choose to provide actual cost distributions (if available) instead.

For example, referring to the direct costs of “Total Permanent Labor” for the given task and month, contractors shall provide estimates of the percentage of these costs that is attributable to each of the assessment types shown, with percentages summing to 100 percent. The example shown in Exhibit 9-4 indicates that, of $54,000 direct permanent labor incurred for this task and month, 10 percent is attributable to the TUDA assessment, 50 percent to the state assessments exclusive of TUDA costs, 30 percent to the “main” national assessment, and 10 percent to the High School Transcript Study.

The NCES cost information system will use the percentages and/or costs provided to calculate estimated costs, including indirect costs, for each Under the Education Sciences Reform Act of 2002 (ESRA 2002), all individually identifiable information about students, their families, and their schools shall remain confidential. To this end, this law requires that no person may:

· Use any individually identifiable information furnished under the provisions of this section for any purpose other than statistical purposes for which it is supplied, except in the case of terrorism

· Make any publication whereby the data furnished by any person under this section can be identified

· Permit anyone other than the individuals authorized by the Commissioner to examine individual reports Further, individually identifiable information is immune from legal process, and shall not, without the consent of the individual concerned, be admitted as evidence, or used for any purpose in any action, suit, or other judicial or administrative proceeding, except in the case of terrorism. Employees, including temporary employees, or other persons who have sworn to observe the limitations imposed by this law, who knowingly publish or communicate any individually identifiable information will be subject to fines of up to $250,000 or up to 5 years in prison, or both (Class E felony).

11.1.4 Protection and Security of Data

The confidentiality of individually identifiable information contained in project documents, data, and other information supplied by the National Center for Education Statistics, U.S. Department of Education (NCES/ED) or information acquired in the course of performance under this contract where the information was furnished under the provisions of Section 183 of the Education Sciences Reform Act of 2002 is a material aspect of the contract and must be maintained, secured, and protected from disclosure as provided in Section 183. The Privacy Act of 1974 (5 U.S.C. 552a) also applies.

The contractor shall enforce strict procedures for assuring confidentiality. These procedures shall apply to all phases of the project and should include but not be limited to: information used to locate study respondents, data collection in the field, coding and editing phases of data prior to machine processing, safeguarding response documents, and maintenance of any respondent follow-up information. Contractor shall physically separate the identifying data required for any follow-up from data required for research purposes.

The contractor shall be familiar with and comply with:

· The Privacy Act of 1974 (5 U.S.C. 552a),

· Confidentiality Information Protection and Statistical Efficiency Act (CIPSEA) of 2002 (P.L. 107-347, Title V, Subtitle A, “Confidential Information Protection”),

· Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. 1232g; 34 CFR Part 99),

· The Freedom of Information Act (5 U.S.C. 552),

· Part C of the Education Sciences Reform Act of 2002 (P.L. 107-279),

· Part E, Section 183 of the Education Sciences Reform Act of 2002 (P.L. 107-279),

· USA Patriot Act of 2001 (P.L. 107-56),

· Office of Management and Budget (OMB) Federal Statistical Confidentiality Order of 1997,

· OMB Guidance of 7/12/2006 on the Reporting of Incidents Involving Personally Identifiable Information (M-06-19), http://www.whitehouse.gov/OMB/memoranda/fy2006/mo6-19.pdf ,

· OMB Guidance of 5/22/2006 on Safeguarding Personally Identifiable Information (M- 06-15) http://www/whitehouse.gov/omb/memoranda/fy2006/m-06-15.pdf,

· Federal Information Security Management Act (FISMA) of 2002 (P.L. 107-347, Title III),

· Every Student Succeeds Act (ESSA)of 2015 (P.L. 114-95)

· Any new legislation that impacts the data collection through this contract.

The contractor shall maintain the confidentiality of all documents, data, and other information supplied by NCES/ED or acquired during performance of this contract, except for any documents or other information specifically designated as non-confidential by NCES/ED. The contractor shall take such measures as are necessary to maintain the required security and protection of confidential information (see section Data Security Plan). The contractor shall be prepared to develop compliance procedures in cooperation with the COR concurrently with the development of the study design.

11.1.5 Data Security Plan

Definition of Personally Identifiable Information and Direct Identifiers The term “personally identifiable information” (hereinafter PII) means any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual. The term “direct identifier” denotes any single datum that alone is deemed sufficient to yield a high risk of disclosure if released, such as social security numbers, full names, or biometric records.

Development of Data Security Plan The contractor shall present a detailed security plan that expands upon what was presented in the proposal to the COR for approval. To ensure the anonymity of individual respondents, the contractor must draft and execute this plan in compliance with all relevant laws, regulations, and policies governing the security of data, particularly PII. These include (but are not limited to):

· Section 183 of the Education Sciences Reform Act of 2002, which states:

· (a) IN GENERAL - All collection, maintenance, use, and wide dissemination of data by the Institute, including each office, board, committee, and center of the Institute, shall conform with the requirements of section 552a of title 5, United States Code, the confidentiality standards of subsection (c) of this section, and sections 444 and 445 of the General Education Provisions Act (20 U.S.C. 1232g, 1232h).

· (b) STUDENT INFORMATION - The Director shall ensure that all individually identifiable information about students, their academic achievements, their families, and information with respect to individual schools, shall remain confidential in accordance with section 552a of title 5, United States Code, the confidentiality standards of subsection (c) of this section, and sections 444 and 445 of the General Education Provisions Act (20 U.S.C. 1232g, 1232h);

· The Privacy Act of 1974 (5 U.S.C. 552a);

· The E-Government Act of 2002 (P.L. 107-347);

· The relevant sections of Title 34 of the Code of Federal Regulations entitled “Protection of Human Subjects” (34 CFR 97);

· The U. S. Department of Education OCIO-1 Handbook for Information Assurance Security Policy (January 2009);

· Office of Management and Budget Memorandum M-06-19, “Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost of Security in Agency Information Technology Investments”;

· OMB Guidance of 7/12/2006 on the Reporting of Incidents Involving Personally Identifiable Information (M-06-19).

The data security plan will, at a minimum, cover the following issues: the transfer/transport of PII, maintenance, storage, and use of direct identifiers, replacement of direct identifiers with internal codes, security of master survey files, security, and confidentiality training for contractor staff, and reporting of data security breaches. Hence, the data security plan shall be written to place particular emphasis on the following aspects of confidentiality and security:

Guidelines for Transfer of PII As a general principle, the physical and/or electronic transfer of PII (particularly direct identifiers) shall be limited to the extent practicable. This limitation includes both internal transfers (e.g., transfer of information between agents of the contractor, including subcontractors and/or field workers) and external transfers (e.g., transfers between the contractor and the agency, or between the contractor and another government agency or private entity assisting in data collection).

When it is necessary for the contractor to transfer PII, such transfer must occur in a manner that maximizes the security of information. The data security plan must describe the likely modes of data transfer and establish the most secure procedures practicable. The most secure method of transferring sensitive information is not necessarily the most efficient or convenient one.

· The preferred means of transferring PII (and particularly direct identifiers) is electronic transfer with 128-bit secure sockets layer (SSL) encryption.

· If electronic PII is transferred via physical media (e.g. a CD-ROM or DVD-ROM is created and sent via courier service or mail), all files on the media shall be encrypted (FIPS 140-2 standard) with a strong password (e.g., a random string of letters and numbers) and this password shall be sent separately from the data. In addition, no obvious external markings or information identifying the media as containing PII shall be written, stamped, or otherwise inscribed on the media or its packing material.

· If paper records or files must be transferred, then the contractor and its agents should hand carry these documents for delivery. Shipping or mailing these kinds of documents should be avoided. The contractor should clearly state in their data security plan if this requirement cannot be met. The data security plan should describe all transfers of paper records or files and how they will be secured. If these documents must be shipped/mailed, the contractor and its agents should avoid transferring multiple direct identifiers in the same shipment. For example, a mailing containing the names, addresses, and social security numbers of subjects is less secure than two mailings: one shipment with the names and addresses and a second shipment with the social security numbers and no additional information. Alternatively, a partial mailing of data could be followed up with a telephone call (for smaller amounts of PII) which provides the remainder of the data verbally. Any shipment sent must have a tracking number. As above, no obvious external markings or information identifying the mailing as containing PII shall be written, stamped, or otherwise inscribed on the packing material.

Maintenance, Storage, and Use of Direct Identifiers Under no circumstances may the contractor release PII to unauthorized individuals. In addition, direct identifiers must be maintained in files which are physically separate from other research data, and which are accessible only to sworn agency and contractor personnel. Individual direct identifiers used during the project shall be associated with data only for statistical purposes such as data gathering, matching new data with old, establishing sample composition, authenticating data collections, editing data based on callbacks, or obtaining missing information.

As a general principal, the number of personnel with access to PII (and particularly direct identifiers) shall be restricted to the smallest number as possible.

Replacement of Direct Identifiers with Internal Codes Although direct identifying information is often required in the data collection process, to the extent practicable the contractor shall use internally generated identifying codes to track subjects in data files. Whenever possible, the transfer and storage of files containing multiple direct identifiers should be avoided. If the transfer of direct identifiers is required for statistical purposes such as data matching, the minimum number of direct identifiers needed for successful matching shall be used.

Security of Master Survey Files The contractor shall maintain security on the complete set (and deliverable backups) of all master survey files and documentation.

Notes from OCIO The Contractor’s information systems shall be developed in accordance with the ED Lifecycle Management Framework (LCM), ACS-OCIO-1-106.

The Contractor shall ensure that the site complies with OMB Memorandum M-03-22 http://www.usa.gov/webcontent/regs_bestpractices/omb_policies/privacy.shtml which requires the posting of privacy policy A “.gov” hostname (typically hostname.ed.gov) is required for all government funded websites under OMB Memorandum M-05-04 (http://www.usa.gov/webcontent/regs_bestpractices/omb_policies/domains.shtml).

The Contractor shall ensure that any “Ed-Sponsored” content must/should be identified prominently with Department of Education, and the ED.gov logo should be displayed prominently and made a link to the ED.gov homepage. The compliance policy is described in the http://www2.ed.gov/internal/wwwstds.html#sponsor.

The Contractor shall ensure that any non-Federal sponsored websites or content (outside of .gov, .mil, .Fed.us, etc.) that is linked to complies with “ED.gov” Management and Publishing Policies at http://www2.ed.gov/internal/wwwstds.html#link and the OMB Memorandum http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-04.pdf The Contractor shall employ a new webhosting service provider. The Contractor shall host the website and its associated IT infrastructure within the boundaries and classification level of a pre-existing FISMA certified boundary that has received Authorized to Operate status by the U.S. Department of Education.

11.1.6 Compliance with ED IT Security Policy

The contractor, and all sub-contractors, shall comply with the Department of Education’s IT security policy requirements, specifically those set forth in the ‘Handbook for Information Assurance Security Policy (OCIO-01)’, and other applicable procedures and guidance. The contractor, and all sub-contractors, shall develop and implement management, operational and technical security controls to assure required levels of protection for information systems. The contractor, and all sub-contractors, shall further comply with all applicable Federal IT security requirements including, but not limited to, the Federal Information Security Management Act (FISMA) of 2002, Office of Management and Budget (OMB) Circular A-130 Appendix III, Homeland Security Presidential Directives (HSPD), and the National Institute of Standards and Technology (NIST) standards and guidance.

These security requirements include, but are not limited to, the successful Certification and Accreditation (C&A) or Security Authorization (SA) of the system (includes commercially owned and operated systems managed by the commercial vendor and its sub-contractors, supporting Department programs, contracts, and projects); obtaining a full Authority to Operate (ATO) before being granted operational status; performance of annual self-assessments of security controls; annual Contingency Plan testing; performance of periodic vulnerability scans; updating all information system security documentation as changes occur; and other continuous monitoring activities, which may include, mapping, penetration and other intrusive scanning. Full and unfettered access for the Department’s third party Managed Security Services Provider (MSSP) must be granted to access all computers and networks used for this system. Additionally, when there is a significant change to the system’s security posture, the system (Federal and commercial prime- and sub- contractors included) must have a new C&A or SA, with all required activities to obtain a new ATO, signed by the Authorizing Official (AO).

System security controls shall be designed and implemented consistent with NIST SP 800-53 Rev 3, ‘Recommended Security Controls for Federal Information Systems and Organizations.’ All NIST SP 800-53 controls must be tested / assessed no less than every 3 years, according to federal and Department policy. The risk impact level of the system will be determined via the completion of the Department's inventory form and shall meet the accurate depiction of security categorization as outlined in Federal Information Publishing Standards (FIPS) 199, ‘Standards for Security Categorization of Federal Information and Information Systems.’

System security documentation shall be developed to record and support the implementation of the security controls for the system. This documentation shall be maintained for the life of the system. The contractor, and all sub-contractors, shall review and update the system security documentation at least annually and after significant changes to the system, to ensure the relevance and accurate depiction of the implemented system controls and to reflect changes to the system and its environment of operation. Security documentation must be developed in accordance with the NIST 800 series and Department of Education policy and guidance.

The contractor, and all sub-contractors, shall allow Department employees (or Department designated third party contractors) access to the hosting facility to conduct C&A/SA activities to include control reviews in accordance with NIST SP 800-53, Rev. 3 and NIST SP 800-53A. The contractor, and all sub-contractors, shall be available for interviews and demonstrations of security control compliance to support the C&A/SA process and continuous monitoring of system security. In addition, if the system is rated as ‘Moderate’ or ‘High’ for FIPS 199 risk impact, vulnerability scanning, and penetration testing shall be performed on the hosting facility and application as part of the C&A/SA process. Appropriate access agreements will be reviewed and signed before any scanning or testing occurs.

Identified deficiencies between required NIST SP 800-53 Rev. 3 controls and the contractors, and all sub-contractor’s implementation, as documented in the Risk Assessment Report, System Security Plan (SSP) and Security Assessment Report (SAR), shall be tracked for mitigation through the development of a Plan of Action and Milestones (POA&M) in accordance with the ‘Handbook for Information Assurance Security Policy (OCIO-01).’ Depending on the severity of the deficiencies, the Department may require remediation before an ATO is issued.

All awarded contracts shall ensure that:

· Their IT product/system is monitored during all hours of operations using entrusted detective/preventive systems;

· Their IT product/system has current antiviral products installed and operational;

· Their IT product/system is scanned on a reoccurring basis;

· Vulnerabilities are remediated in a timely manner on their IT product/system; and

· Access/view for cyber security situational awareness on their IT product/system is made available to the Department CIRC (cyber incident response capability).

For Internet Protocol version 6 (IPv6), the contractor shall provide COTS solutions that are IPv6 capable. An IPv6 capable system or product shall be capable of receiving, processing, transmitting, and forwarding IPv6 packets and/or interfacing with other systems and protocols in a manner like that of IPv4. Specific criteria to be deemed IPv6 capable are:

· An IPv6 capable system that meets the IPv6 base requirements defined by the USGv6 Profile and Testing program as found here: http://w3.antd.nist.gov/usgv6/testing.html .

· Systems being developed, procured, or acquired shall maintain interoperability with IPv4 systems/capabilities.

· Systems shall implement IPv4/IPv6 dual-stack and shall also be built to determine which protocol layer to use depending on the destination host it is attempting to communicate with or establish a socket with. If either protocol is possible, systems shall employ IPv6.

The contractor shall provide IPv6 technical support for system development, implementation, and management.

11.1.7 Reporting of Data Security Breaches

If there is a suspected or known breach/disclosure of PII due to lost, theft, intercepted transfer, or other, the contractor must ensure that this breach is reported to the agency as soon as the contractor has knowledge of it. Per Office of Management and Budget Memorandum M-06-19, Federal agencies have a requirement to report breaches of PII security to a Federal incident response center. NCES must notify the department within 30 minutes of discovering the incident (and the agency should not distinguish between suspected or confirmed breaches). The data security plan must be written to reflect this requirement, and the contractor must provide sufficient notification and documentation of the suspected loss, as it is understood at the time of notification to the agency for this requirement to be met. Follow-up reports of the final status of loss events will also be prepared by the contractor within a reasonable period as advised by the NCES COR.

11.1.8 Freedom of Information Act (FOIA) Requests

If the contractor receives a FOIA request for any data under this contract, then the contractor shall immediately refer this request to the COR. NCES will process all FOIA requests related to this contract.

Implementation of Data Security Plan The contractor shall conform to the agreed-upon approved data security plan, in all activities, and shall strictly enforce all procedures for ensuring confidentiality. These procedures will apply to all phases of the project, including (but not limited to):

· Data collection in the field

· The transfer or transport of PII in any format, including paper records and electronic data files

· Coding and editing phases of data prior to machine processing

· Safeguarding and storage of master data files and response/collection documents and electronic files To monitor compliance with the data security plan during data collection period, the contractor shall submit monthly timelines and data receipt reports that identify (1) the percent of cases transmitted within the target time; (2) the percent of cases received within the target time (paper); and (3) any outliers (e.g.: missing transmissions) and their causes with recommendations for solutions to be implemented in the next reporting period.

11.1.9 Adherence to NCES Statistical Standards

NCES Statistical Standards NCES has developed and implemented a set of statistical standards that set guidelines to ensure the quality of NCES' work (see NCES Statistical Standards, NCES 2003-601). These standards (as amended) are to be followed by NCES staff and their contractors in performing the day-to-day work of NCES. A copy of the standards and proposed revisions are available at the website: http://nces.ed.gov/statprog/ . In addition, contractors shall follow content and format guidelines described in the IES style guide, found at:

http://nces.ed.gov/statprog/styleguide/pdf/styleguide.pdf

11.1.10 Quality Control Measures Requirement

Quality Control Measures NCES is firmly committed to determining how well each project meets its goals, the quality of data collected, and its implications for future projects. Project quality control shall be integrated into every phase of the project. For instance, potential problems should be identified early so that possible solutions are tested as part of the field test. Item reliability and validity tests must be built into the data collection efforts, non-response bias analyses should be conducted as part of the final weighting process, and survey methodology and sample design effects should be made available to all data users. Thus, statistical quality control shall be incorporated into each project stage as appropriate.

Contractor Employee Security Screening Contractor Employee Security Screening Requirements The Department has established policy on personnel security screening for all contractor and subcontractor employees and their field staff. The relevant Departmental Directive is OM:5-101. It was last updated in July 2010 and can be found at: http://www2.ed.gov/policy/gen/leg/foia/acsom5101.pdf . The contractor must comply with the personnel security-screening requirements in OM:5-101 throughout the life of the contract.

All contractor and subcontractor employees must undergo personnel security screening if they will be employed for thirty (30) days or more.

The type of screening and the timing of the screening will depend upon the nature of the contractor position, the type of data the contractor employee will have access to, or the type of Departmental information technology (IT) system they will access. Personnel security screenings will be commensurate with the risk and magnitude of harm the individual could cause to the Department or the public. A position risk level will be assigned to each contractor employee position, before a solicitation is released, consistent with the descriptions in Appendix I of OM:5-101. Hence, each contractor employee working on this contract must be assigned a position risk level. Depending on the risk level assigned to each person's position, a follow-up background investigation by the Office of Personnel Management (OPM) may occur.

The contractor must identify one of their employees as a security liaison for this process. This Contractor Security Liaison coordinates the distribution, collection, and dissemination of various forms required in this process. They answer general questions from their employees on completing the security screening process. And they are the first point of contact for contractor employees in using the OPM’s Internet based security screening portal called e-QIP ( http://www.opm.gov/e-qip/ ). The contractor is also responsible for ensuring that all subcontractors follow these personnel security screening procedures.

NCES requires each contractor employee to have or apply for a clearance for the security level designated for the position held on a contract.

Contractor employees who have undergone appropriate personnel security screening for another Federal agency will be required to submit proof of that personnel security screening for validation. For these employees, the contractor or subcontractor must follow these required steps:

· The contractor must send the COR a letter on Company letterhead that lists the full name of each employee with a pre-existing clearance, the agency that cleared the employee, the level of the clearance, and the date of the clearance. This letter must be transmitted to the COR within two (2) business days of starting work on an NCES contract.

· In those cases where any of the required information on level of clearance, agency that cleared the employee and date of clearance is not available, the contractor must send the COR a letter on Company letterhead that lists the full name and Social Security Number for each employee with a pre-existing clearance. This letter must be transmitted to the COR within two (2) business days of starting work on an NCES contract.

· The COR will transmit the letter to the NCES Security Representative for processing.

· The NCES Security Representative reviews the letter to ensure that the required information is provided and either returns it to the contractor for completion or releases it to the Department of Education Chief of Personnel Security. The contractor must resubmit the letter to the COR within 7 business days or the contractor employee must be removed from the contract.

· The NCES Security Representative will notify the contractor or subcontractor if the pre-existing clearance was identified and ruled to be acceptable by the Department of Education Chief of Personnel Security.

· Those employees whose pre-existing clearances are not verified and approved must follow the process outlined next to apply for a security clearance.

For contractor employees who have not undergone appropriate personnel security screening for another Federal agency, all contractors must comply with the Principal Office (PO) Executive Office or Computer Security Officer’s pre-processing requirements for personnel security screening and granting access privileges. No contractor employees are permitted unsupervised access to unclassified sensitive information (i.e., personally identifiable information), direct access to respondents who are minors, or Department of Education IT systems until they have submitted applicable security screening documents.

For each contractor employee in a moderate risk level position the completed security screening documents must be accepted by the COR and the NCES Security Representative and submitted to the Department of Education Chief of Personnel Security within 14 days of the date the contractor employee starts working on the contract. To meet this Departmental requirement, steps 1 through 7 must be completed within 14 days of the date the contractor employee starts working on the contract. To meet this 14-day deadline and the interim deadlines specified below, it is strongly recommended that the contractor request the account initiation three (3) weeks before the contractor employee starts contract work and encourage each contractor employee to complete all required security screening forms before starting contract work.

Contractor employees in High-Risk IT (6C) Level positions require preliminary personnel security screenings before they are given access to unclassified sensitive information or Department of Education IT systems (see page 7 of OM:5-101 for more details).

The security screening of contractor and subcontractor employees not holding ED recognized security screening credentials must follow these required steps:

· The contractor must provide the COR with an electronic listing of all employees on a specific contract, with the risk level associated with the position held by each employee as specified in the contract solicitation. The COR will review the electronic listing for completeness and approve. The listing will not be approved if it is found to be incomplete.

· The Department of Education participates in the OPM e-QIP system to facilitate the security screening process for contractor employees. NCES will initiate an e-QIP account for each contractor employee. It is advisable to request the account initiation three (3) weeks before the contractor employee starts contract work. For the initiation of these accounts, the Contractor Security Liaison must use the COR-approved list of employees and the risk levels assigned to the employees’ positions to produce and submit the following list using the attached template:

· For each contractor employee provide: Social Security Number, Full Name, Date of Birth, Place of Birth, risk level, e-Mail Address, and phone number. The Contractor Security Liaison must place the spreadsheet in a password protected file, then upload the list to the NCES secure server, and send an e-mail notification of the transmission to the NCES Security Representative. The NCES security staff will use this list to establish the contactor employee e-QIP accounts. The COR will work with the contractor to establish access to the NCES secure server at the outset of the contract.

· Once NCES sets up the e-QIP accounts for contract employees, the NCES Security Representative will send an email to the Contractor Security Liaison stating that the employee has an active account on the e-QIP system. The COR is copied on this email notification.

· The Contractor Security Liaison must notify their employees of this active account. A computer with Internet access and web browsing software is required for the contractor employee to access their E-QIP account. Each employee must log into their personal account in e-QIP, enter the requested information, finish the application process and print, sign, and date the e-QIP signature pages.

· Each contractor employee must submit a completed set of security screening forms to their Contractor Security Liaison as provided by the NCES Security Representative, including for example:

· The signed and dated e-QIP signature pages,

· The Declaration of Federal Employment (OPM form OF-306),

· The Fair Credit Release Form,

· The Request for Security Officer Action (RSA) Form,

· The contractor employee shall complete only those items in section 1 of the form (name, date of birth, place of birth, organization, position title, duty station, social security number, and work phone number).

· The contractor shall complete section 5 (Project Requiring Highest ADP Level) using the assigned security clearance for each employee’s position.

· Two sets of fingerprints on separate copies of form FD-258,

· The Contractor Security Liaison shall help arrange fingerprinting for each contractor and subcontractor employee. Fingerprinting can usually be done at a local police station. (Electronic fingerprints are not accepted currently.)

· Each contractor must ensure that the forms are complete and that all contractor employee required security screening forms are transmitted to the COR within two (2) business days of an employee starting work on an NCES contract.

· The Contractor Security Liaison must collate the forms in each security screening package by employee and transmit a complete set of security screening documents for each employee to the COR via courier (e.g., Federal Express) using a tracking number with signature required,

· The COR will not accept security screening packages that are not collated by employee (i.e., all forms noted in point 3 above will be bundled by employee). The COR will review all security screening documents for each contractor employee for completeness, returning any incomplete security screening documents to the Contractor Security Liaison for completion. The contractor must resubmit the completed security screening documents to the COR within 7 business days or the contractor employee must be removed from the contract. No contractor employees are permitted unsupervised access to unclassified sensitive information (personally identifiable information), direct access to respondents who are minors, or Department of Education IT systems until they have resubmitted applicable screening documents.

· The COR will submit the completed packages of security screening documents to the NCES Security Representative for processing.

· The NCES Security Representative reviews each package of security screening documents and electronic information submission to ensure everything required has been provided and either rejects the package, sending it back to the submitter for completion/correction or releases it to the Department of Education Chief of Personnel Security. If an application is rejected at this stage, the contractor must resubmit the corrected forms to the COR, or have the contractor employee correct the e-QIP submission, within two business days. The NCES Security Representative must be notified as soon as the updated e-QIP submission is completed.

· The contractor employee application for everyone in a moderate risk level position must be submitted to the Department of Education Chief of Personnel Security within 14 days of the date the contractor employee starts working on the contract. Contractor employees in High-Risk IT (6C) Level positions require preliminary personnel security screenings before they are given access to unclassified sensitive information or Department of Education IT systems.

· After a package of security screening documents is transmitted to the Department of Education Chief of Personnel Security, the Office of Management security staff conducts a further review and either rejects the package of security screening documents, sending it back to the submitter for completion/correction or releases it to OPM.

· OPM then assigns an investigator to conduct the type of investigation indicated by the department (this is tied to the level of access to PII that the applicant will have).

· The Chief of Personnel Security will request the expansion of background investigations to obtain additional information to the extent necessary to make personnel acceptability or suitability determinations. These determinations will be made using criteria established by the OPM for the purpose of determining suitability for employment in the Federal competitive service, as described in 5 CFR 731.202, and other OPM guidance as applicable. The Chief of Personnel Security determines whether a contractor employee is acceptable for the position from a personnel security standpoint.

· When the OPM investigation is complete, the RSA form with the clearance indicated is sent to the Department of Education’s Office of Management for processing.

· The Office of Management returns the RSA form to the NCES Security Representative for recordation and distribution to the COR.

· The COR transmits the RSA form with clearance indicated to the Contractor Security Liaison for their records and for distribution to the Contract Project Leader.

· The Contract Project Leader then distributes copies of the clearance to the employee.

· The Chief of Personnel Security will inform the NCES COR when he or she determines that a contractor employee is not acceptable to render service(s) or, if appropriate, to otherwise perform under a contract.

· Each contractor shall officially notify its contractor employee if he or she will no longer work on an ED contract.

· In the event a contractor employee is deemed unacceptable for the position from a personnel security standpoint, the Chief of Personnel Security will usually provide the contractor employee with an opportunity to refute, explain, clarify, or mitigate information in question.

· If, after final determination by the Chief of Personnel Security, a decision is made that the contractor employee is not acceptable to render services on a contract and access is denied, the COR will inform the Contracting Officer. The Contracting Officer must inform the contractor (i.e. employing firm) that the contractor employee is not acceptable to render services in this position, or, if appropriate, to otherwise perform under the contract. The contractor shall notify the contractor employee. A final determination cannot be appealed.

· At any time during the life of the contract a contractor or subcontractor employee (including any field staff) discontinues work on the contract or leaves the employment of the contractor, the contractor shall notify the COR within two days of the date that the employee is no longer working on the contract or within one business day if removed for cause. The contractor shall provide the reason why the employee is no longer working on the contract. The COR will provide this information to the NCES Security Representative.

· Each contractor is responsible for the protection of sensitive or Privacy Act-protected information from unauthorized use or misuse by its employees, subcontractors, or temporary workers, and for preventing access to others, who are not authorized and have no need to know such information.

· The contractor shall submit monthly information to the COR indicating which employees were billed to the contract that include the e-QIP number of the person being billed. The COR will reject payments to employees without an e-QIP number. For employees with pre-existing clearances from other contracts, this shall be noted on the monthly payment form.

The contractor shall verify with the COR that the security screening processes have not changed by the time the contract is active.

11.1.11 INFORMATION MANAGEMENT CONTRACT REQUIREMENTS

The contractor shall manage and ensuring accessibility to Federal records (on any medium such as paper, systems, applications, etc.) that is made or received in connection with the transaction of Department business as part of a contract. The following requirements are divided into two sections, which are mandatory: (1) Records and CUI, (2) Accessibility requirements related to Section 508 of the Rehabilitation Act.

RECORDS AND CONTROLLED UNCLASSIFIED INFORMATION (CUI)

· "Federal record" as defined in 44 U.S.C. § 3301, includes all information, made or received by a Federal agency in connection with the transaction of public business. ED owns rights to all records produced as part of this contract. Any Contractor rights must be identified as required by FAR 52.227-11 through FAR 52.227-20.

· Federal records must be managed according to the applicable records management laws and regulations, to include the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), 36 CFR Chapter XII Subchapter B, and the Privacy Act of 1974 (5 U.S.C. 552a).

· Federal records which are CUI must additionally be managed in accordance with any applicable laws, regulations and government-wide policies (LRGWP) to include EO 13556, 32 CFR Part 2002, ED Directive OCIO 3-113, and NIST-800-171 Revision 2 (or…