Attachment 1 - DR-RUD PWS 5.21.26.pdf

Attachment 1 – Performance Work Statement (PWS)

U.S. Department of Education Institute of Education Sciences

Performance Work Statement (PWS) IES Data Repository and Restricted Use Data (DR-RUD) Program

Amendment 1 – Changes highlighted in yellow Version: Dated May 21, 2026

DR-RUD PWS Version 2 - 5/21/2026

Table of Contents Table of Contents

1. Introduction

2. Legislative Authority

3. Purpose of Scope of Work

4. Requirement Context

5. Scope of Work

5.1 Task 1: Meetings | Non-Optional

5.2 Task 2: Data Stewardship, Project Management and Reporting | Non-Optional

5.3 Task 3: Subject Matter Expertise

5.4 Task 4: Export and Export Review | Non-Optional

5.5 Task 5: Export Reviewer Seats | Non-Optional

5.6 Task 6: Confidential Information Protection and Statistical Efficiency Act (CIPSEA) and Education Sciences Reform Act (ESRA) Training

5.7 Task 7: IT System Security Compliance

5.8 Task 8: Phase-out Support | Optional

6. Key Personnel/Staff Qualifications

7. Quality Control and Assurance

8. Additional ED and Federal-Wide Requirements

8.1 Records and Controlled Unclassified Information (CUI) Requirements

8.2 IT Accessibility Requirements (Section 508 of the Rehabilitation Act)

8.3 Security Clearance Requirements

8.4 Additional Information System Requirements

9. Data Ownership, Rights, and Custody

9.1 Data Storage

9.2 Confidential Treatment of Sensitive Information

10. Attachments

10.1 Attachment 1.A Quality Assurance Surveillance Plan (QASP)

1. Introduction The Institute of Education Sciences (IES) is the statistics, research, and evaluation arm of the U.S. Department of Education (ED). The goal of IES is to provide national leadership in expanding fundamental knowledge and understanding of education from early childhood through postsecondary study, in order to provide parents, educators, students, researchers, policymakers, and the general public with reliable information about the condition and progress of education in the United States, from early childhood through postsecondary education; educational practices that support learning and improve academic achievement and access to educational opportunities for all students; and the effectiveness of federal and other education programs.

The Education Sciences Reform Act (ESRA, Title I of P.L. 107-279) established IES as an independent research arm of ED. Title I, Part A, of ESRA establishes IES as a research institute within ED, intended to provide “national leadership in expanding fundamental knowledge and understanding of education from early childhood through postsecondary study.” IES is authorized to carry out these objectives by compiling statistics, conducting research and evaluations, and disseminating information.

IES executes its mission through four national education centers and an Office of the Director:

• The National Center for Education Research (NCER) sponsors research leading to the accumulation of knowledge and understanding of education.

• The National Center for Education Statistics (NCES) collects and analyzes education information and statistics in a manner that meets the highest methodological standards.

• The National Center for Education Evaluation and Regional Assistance (NCEE) supports evaluation, technical assistance, development, and dissemination activities.

• The National Center for Special Education Research (NCSER) sponsors research to expand knowledge and understanding of the needs of infants, toddlers, and children with disabilities.

• The Office of the Director carries out specific duties, such as proposing research priorities and establishing procedures for technical and peer review. The Standards and Review Office (SRO) carries out rigorous peer review of all research, statistics, and evaluation reports conducted by, or supported through, the Institute and falls under the Office of the Director.

2. Legislative Authority Section 154 of ESRA allows the NCES Commissioner to “enter into contracts” to carry out his or her duties under ESRA Part C. Those duties include the dissemination of statistical data (Section 151 of ESRA) and providing copies of “statistical records ... for State and local officials, public and private organizations, and individuals” (Section 156(a)(1) of ESRA).

Notably, those authorized activities must be done in a manner that preserves the confidentiality of statistical data (see ESRA Section 183 and the Confidential Information Protection and Statistical Efficiency Act).

Title 20 authorizes NCES to recover costs for special statistical work (20 U.S.C. § 9546(d)) and to set terms and conditions for data access (20 U.S.C. § 9546(e)(2)), while public‑availability is qualified by confidentiality (20 U.S.C. §§ 9574, 9573). The government‑wide user‑charge statute (31 U.S.C. § 9701) and OMB Circular A‑25 permit cost‑based fees for services that confer a special benefit.

3. Purpose of Scope of Work This requirement enables researchers to seek and obtain secure, remote access to approved IES Restricted Use Data (RUD), most notably data from NCES and NCEE, for approved research projects. Secure, remote access to these data strengthens the evidence base for policymakers and educators while enhancing the security of restricted use data assets.

4. Requirement Context This requirement contributes to IES’s and ED’s mission to promote evidence-building for policymakers and the education field. Ensuring researchers’ secure, remote access to RUD fulfills IES’s mission to provide evidence to guide education practice and policy, with a focus on improving student outcomes, while meeting IES’s responsibilities to protect confidential information collected for statistical purpose.

Secure, remote access to a subset of restricted use datasets has been successfully provided by an organization currently under contract. Originally, the organization provided secure access to IES Restricted Use License holders under a contract administered by the National Science Foundation that included support for IES requirements. Now, IES has a separate, short-term contract with that same vendor to serve as a “bridge” during this acquisition process.

Another subset of users continue to access RUD with physical media, such as CD-ROMs. All activities related to physical media are managed via a separate IES contract and contractor. IES seeks to improve the security of its RUD program by transitioning all physical licensees to remote access for their approved data by September 30, 2026.

This requirement supports NCES’ transition to a fully digital Restricted Use Data License program through the use of a virtual data enclave, overseeing the eventual removal physical media with RUD from circulation, and running key aspects of the RUD license application process to expand secure, remote access to new users and new data.

Historically, the RUD license application process—for both remote access and access to physical media—has had the following steps:

1. A user submits their application via the Standard Application Process (SAP) at researchdatagov.org;

2. The application is downloaded from the SAP by an existing IES contractor to an existing internal license tracking database;

3. Applications are reviewed by the IES contractor for their completeness and accuracy;

4. Subject matter experts at IES familiar with the requested data review the proposed research plan to ensure that it can support the requestor’s research needs;

5. IES leadership approves the new license and access to data is provided.

Applicants may apply for multiple datasets under a single license, and multiple users may be associated with a license depending on how research activities are to be conducted (e.g., a faculty member may be the license-holder, and his or her graduate research assistances may be “additional users” for the purpose of completing one or more projects.) The license database is regularly updated to reflect such changes.

Finally, when research outputs are prepared, they must be reviewed by IES (or its designee) for compliance with standards designed to prevent inadvertent disclosure of confidential information. This process is referred to as Disclosure Risk Review (DRR). Historically, researchers transmit proposed manuscripts, presentations, or equivalent to IES DRR reviewers who then evaluate materials for disclosure risk and request edits as needed. Only after materials have successfully cleared the DRR review process may those materials be shared with individuals outside of the submitter’s license. Presently, license holders who have virtual access to RUD have exports from the enclave preliminarily reviewed by enclave staff to ensure there are no immediate disclosure risks prior to eventual submission to IES for a formal review.

5. Scope of Work

5.1 Task 1: Meetings | Non-Optional

Subtask 1a: Contract Kick-Off Meeting/Annual Option Period Meetings Within one (1) week of contract award in the base period and all exercised option periods, the contractor shall conduct a kick-off meeting virtually using an electronic meeting platform. A detailed meeting agenda shall be circulated no later than 48 hours prior to the meeting. The agenda will list items to be discussed and the time allotted for each item. Within 24 hours of the meeting, a final agenda will be published and circulated to all invitees. A completed meeting minutes template, which combines the meeting agenda with minutes and action items, will be disseminated to all invitees within one (1) week after the meeting.

Subtask 1b: Support for the IES Restricted-Use Data License Application Meetings The contractor must establish, in coordination with the Contracting Officer’s Representative (COR), regular weekly communications to take place on an online platform approved by the Department. The contractor must plan for an online meeting monthly with IES of approximately 75 minutes in length.

Table 2: Deliverables for Task 1

Deliverable No.: Deliverable Name

Deliverable Due Date Period of Performance

1.1 Kickoff Meeting

Agendas and Notes

Agendas to be provided no later than 48 hours prior to the meeting; meeting to be scheduled within one week of award and Option Period exercise.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

1.2 Kickoff Meeting

Minutes

Within one (1) week of kick-off meeting.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

1.3 Monthly Meeting

Agendas and Notes

Monthly, to begin the week after kick-off.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

5.2 Task 2: Data Stewardship, Project Management and Reporting | Non- Optional

The contractor shall host a data repository (DR) for IES Restricted Use datasets. The contractor shall ingest and host all data currently available in IES’s existing data repository (roughly 320 data sets, with an average file size of 850MB)1. The contractor shall add to the data enclave roughly 60 additional data sets by September 30, 2026. Following that date, the contractor shall add to the data repository, approximately 5 data sets per year. IES anticipates bearing the cost of this data infrastructure.

Approximately five thousand users will be granted access to the DR at any given time. Each user must have a separate, private workspace that allows for the storage of statistical code and work product as well as provisioned access to the data file(s) to which they have been approved by IES to access. The contractor will permit secure researcher access to said datasets only after receiving notification from NCES that access has been approved and shall revoke access upon demand.

IES intends to collect a fee covering the costs associated with user workspaces. IES will not be charging for data use but rather for the provision of data access in a secure digital environment that preserves strict confidentiality protections as required under CIPSEA, including a disclosure risk review of any products developed by the users in the virtual workspace, such as analyses.

1 Note, IES will provide the contractor with all data files for ingestion. IES also anticipates a transfer of all researcher work products within the current data enclave to the new data enclave.

The government‑wide user‑charge statute (31 U.S.C. § 9701) and OMB Circular A‑25 permit cost‑based fees for services that confer a special benefit. Under this premise, the contractor shall propose a Contractor‑Collected/Price‑Offset model under which the contractor charges users for enclave services under government-approved schedules and ED receives invoice credits tied to documented collections.

At any given time, IES anticipates approximately 5,000 users across 1,000 licenses. The contractor shall work with IES to determine a payment workflow following a Contractor- Collected/Price-Offset model which:

a) Meets all statutory requirements

b) Ensures only costs specific to usage are charged to the users

c) Minimizes burden to users and the government

Monthly reporting shall include numbers of user licenses, users per license, and data byte usage, broken down by the contractor’s specific pricing model.

The contractor shall provision the enclave with statistical software appropriate to the analysis of quantitative, complex survey data. This shall include open source (e.g., R, python) and non-open source (e.g., Stata) software solutions. The contractor is responsible for purchasing and maintaining licenses for this software in the most cost-effective manner possible. The contractor shall provide user support via email or phone with a 24-hour response time on weekdays.

The contractor shall provide a plan to transition all files and documentation at the end of each period of performance to ensure minimal disruption to continuous service. The contractor shall implement project management processes as are needed to ensure the timely achievement of the government’s requirements and shall document the same as required in the table of deliverables listed below.

The Contractor shall establish and maintain appropriate internal operational and system controls supporting the confidentiality, integrity, availability, accountability, and traceability of Restricted Use Data (RUD) access and associated user fee activities performed under this contract.

At a minimum, the Contractor shall:

• Maintain complete and accurate records of all user fee transactions, including assessments, collections, refunds, adjustments, waivers, and related communications;

• Maintain system-generated audit trails sufficient to trace user account activity, data access events, fee transactions, approvals, administrative changes, and privileged-user actions;

• Ensure audit logs are protected from unauthorized modification or deletion and retained in accordance with contractually established retention requirements;

• Implement role-based access controls and least-privilege principles for all systems, applications, and administrative functions supporting RUD access or fee collection activities;

• Perform periodic user access reviews and promptly disable accounts that are inactive, unauthorized, or no longer required for contract performance;

• Maintain segregation of duties, where practicable, between personnel responsible for user administration, fee processing, reconciliation, approvals, and system administration functions;

• Maintain documented procedures for transaction processing, exception handling, reconciliations, incident response, and records retention;

• Reconcile user fee records, system activity, and remittance data on a periodic basis and promptly identify and resolve discrepancies;

• Notify the Government within 24 hours of identifying any suspected unauthorized access, loss of data, improper fee activity, control failure, fraud indicator, or other security or integrity concern affecting RUD or associated collections activities;

• Provide the Government, authorized auditors, inspectors, or oversight officials with access to records, reports, supporting documentation, audit trails, and system-generated logs related to performance under this contract upon request;

• Support Government oversight, monitoring, audit, risk assessment, internal control review, and investigative activities related to this contract;

• Retain all records associated with user access, fee collections, reconciliations, approvals, audit logs, and supporting documentation for a minimum of 4 years after final payment or longer if required by applicable law, regulation, litigation hold, or Government direction; and

• Comply with all applicable federal information security, privacy, records management, and confidentiality requirements associated with Restricted Use Data.

The Contractor shall ensure that subcontractors supporting these activities are subject to equivalent control, security, auditability, and records retention requirements.

Table 3: Task 2 Deliverables

Name Deliverable Due Date Period of Performance

2.1 Pricing Model Final model within 2 weeks of kickoff

meeting; updated annually thereafter.

Base Period Option Period 1 Option Period 2

Deliverable Due Date Period of Performance

2.2 Monthly Reports Monthly cadence beginning in July, 2026.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

2.3 Transition Out

Plan

Annually, at the close of each base and option period.

Base Period Option Period 1 Option Period 2

5.3 Task 3: Subject Matter Expertise

The contractor must recruit Subject Matter Experts (SME) who possess sufficient knowledge to make determinations regarding the feasibility of research projects proposed by applicants (see “Requirement Context” above).

This requires expertise in the NCES data collections below (as a group of SMEs) as well as knowledge of high-quality education and/or behavioral research using sample-survey of similar data (as individual SMEs).

Given the data currently available to be licensed, expertise must be maintained across the areas of:

a. National Teacher Principal Survey (NTPS) and Schools and Staffing Survey (SASS)

b. National Postsecondary Student Aid Study (NPSAS), Baccalaureate and Beyond

Longitudinal Study (B&B), Beginning Postsecondary Study (BPS)

c. Early Childhood Longitudinal Study (ECLS) and National Household Education

Surveys Program (NHES)

d. Middle Grades Longitudinal Study (MGLS) and High School & Beyond (HS&B)

e. National Assessment of Educational Progress (NAEP)

f. Civil Rights Data Collection (CRDC)

g. Trends in International Mathematics and Science Study (TIMSS), Program for

International Student Assessment (PISA),

h. Private School Survey (PSS) and Common Core of Data (CCD)

Subject matter experts will review RUD applications for research proposal feasibility and provide guidance to NCES RUD applicants regarding data availability. Unless otherwise and specifically permitted by NCES, the contractor must make determinations regarding applications within 30 days of submission by the applicant.

Table 4: Deliverables for Task 3 Deliverable No.: Deliverable Name Deliverable Due Date Period of Performance

3.1 Documentation of

Subject Matter Experts’ Skills, Knowledge, Training and/or Experience

Within one (1) week of award, and then updated when SMEs are added or removed from the contract.

Base Period Option Period 1 Option Period 2

5.4 Task 4: Export and Export Review | Non-Optional

The DR shall prevent users from exporting content prior to review. The contractor shall review all outputs generated from restricted use data, and implement technologies and processes as needed to ensure outputs are not exported from the DR until their compliance with those NCES statistical standards designed to prevent the disclosure per personally-identifiable information is fully met (see https://nces.ed.gov/statprog/). While NCES retains ultimate authority regarding determinations of disclosure risk, the contractor shall maintain sufficient expertise to make final determinations on NCES’ behalf.

Unless otherwise and specifically permitted by NCES, the contractor must process each export within 30 days of submission by the user. The contractor shall, as described below, provide a summary of export reviews to the government monthly as a component of its monthly report.

Table 5: Task 4 Deliverables

Name Deliverable Due Date Period of Performance

4.1 Summary of

Export Reviews

Monthly, the contractor shall list each export review conducted, including the associated user, data file, date the review was received, date the review was completed, and the elapsed time of the review.

Base Period Option Period 1 Option Period 2

5.5 Task 5: Export Reviewer Seats | Non-Optional

The contractor shall provide login access to the DR for up to 10 government-specified users for the purpose of verifying export reviews conducted by the contractor in Task 2 above.

The contractors shall provide training to said users on the proper use of the DR for verification of export reviews.

Table 6: Task 5 Deliverables https://nces.ed.gov/statprog/

Deliverable Due Date Period of Performance

5.1

Logins & training materials for up to 10 users

Within one week of award Base Period Option Period 1 Option Period 2

5.6 Task 6: Confidential Information Protection and Statistical Efficiency Act (CIPSEA) and Education Sciences Reform Act (ESRA) Training

The contractor shall be responsible for developing training materials regarding the responsibilities of using data protected by CIPSEA and/or ESRA. The contractor should consider the extent to which those training materials might differ between three intended audiences: (a) IES staff, (b) restricted use license applicants, and (c) existing restricted use licensees.

The contractor shall also be responsible for designing and implementing a program that ensures audiences (a) and (c) above complete relevant training annually, and maintain records associated with training completion.

Table 7: Task 6 Deliverables

Deliverable No.: Deliverable Name

Deliverable Due Date Period of Performance

6.1 Training Plan, detailing proposed training modules, content, and audiences

Within 2 months of the contract award. Base Period

6.2 Training

Materials

Within 6 months of contract award. Base Period

6.3 Training Status

Update, identifying to IES any individuals who have failed to complete annual training requirements.

March 1, 2027 March 1, 2028 March 1, 2029 March 1, 2030 March 1, 2031

Base Period Option Period 1 Option Period 2

5.7 Task 7: IT System Security Compliance

To ensure the protection of Department of Education (ED) information and systems, all contractor personnel performing work for ED must strictly adhere to a comprehensive set of federal and Department-specific security requirements. These mandates, detailed on the official ED website, cover areas such as personnel security, IT system security, privacy, incident reporting, and data handling, all designed to safeguard sensitive data and maintain the integrity of ED's operational environment. The contractor is responsible for implementing robust security controls, complying with federal regulations and ED policies, and ensuring their systems and practices meet the stringent standards necessary for working with federal information. This Performance Work Statement further details the specific technical and procedural security obligations required for the successful execution of this contract.

Per the Federal Information Security Modernization Act (FISMA) and supporting Department of Education Regulation (EDAR) 3452.239-71 Department Information Security and Privacy Requirements (https://www.acquisition.gov/edar/3452.239-71-department-information-security-and-privacy-requirements.?searchTerms=3452.239-71), the Contractor, and all sub-contractors, shall comply with the Department of Education’s IT security policy requirements, specifically those set forth in the Security Requirements for Contractors Doing Business with the Department of Education (https://www2.ed.gov/fund/contract/about/bsp.html). Additionally, the contractor, and all sub-contractors, shall develop and implement management, operational and technical security controls to ensure required levels of protection for information systems. Furthermore, the contractor, and all sub-contractors, shall further comply with all applicable Federal IT security requirements including, but not limited to:

• Office of the Chief Information Officer’s (OCIO) Personally Identifiable Information (PII) Processing and Transparency Standard

• Departmental Directive ACSD-OPEPD-002 Personally Identifiable Information Breach Response Policy and Plan

• Appendix III to Office of Management and Budget (OMB) Circular A-130

• Most recent applicable National Institute of Standards and Technology (NIST) special publications, standards and guidance

Any new information system intended for operation, and subsequent authorization, within the Department of Education (ED) environment shall first undergo and receive approval through the Department's Enterprise Architecture Technology Insertion (EATI) process. This EATI approval is a prerequisite that provides a risk evaluation for initial use/authorization that will then guide the subsequent detailed system authorization process, as supported by the technical requirements outlined in this Performance Work Statement (PWS). The EATI approval memo will explicitly define the timeline for the Contractor to complete all aspects of the authorization process as well as any specific requirements noted by each approval authority as it relates to security and/or privacy. Strict adherence to this timeline is critical, as failure to meet the specified requirements https://www.acquisition.gov/edar/3452.239-71-department-information-security-and-privacy-requirements.?searchTerms=3452.239-71 https://www.acquisition.gov/edar/3452.239-71-department-information-security-and-privacy-requirements.?searchTerms=3452.239-71 https://www2.ed.gov/fund/contract/about/bsp.html will result in significant implications for the system's authorization status, risk scorecard, and may negatively impact the associated program office.

Subtask 7.1: Rapid Risk Assessment (RRA) Requirements Prior to initial authorization as part of the EATI process, the Contractor shall ensure the new system is prepared to address and demonstrate compliance with critical security controls during the Rapid Risk Assessment (RRA). This readiness includes, but is not limited to, the following areas:

1. System Registration within GRCT:

a. The Contractor shall ensure that all points of contact for the system are accurately recorded and maintained within the Governance, Risk, and Compliance Tool (GRCT), formerly known as Cybersecurity Assessment and Management

(CSAM).

b. The Contractor shall ensure that the Federal Information Processing Standards (FIPS) 199 Categorization for the system's impact level (Confidentiality, Integrity, Availability) is completed and documented within CSAM.

c. The Contractor shall also document and verify all hosting locations, including Cloud Service Providers (CSPs), primary data centers, and disaster recovery sites, along with their respective management offices, primary, and alternate locations within the CSAM system profile.

2. Vulnerability and Compliance Scanning: The system shall demonstrate active and effective vulnerability and compliance scanning processes and provide the ability for the results to be ingested into the Department cyber data lake solution.

3. Encryption: The system shall implement robust encryption for both data in transit and data at rest.

4. Audit Log Capabilities: The system shall possess comprehensive audit logging capabilities, capturing relevant security events in accordance with M-21-31.

5. Audit Correlation Capabilities: The system shall support the correlation of audit logs to facilitate security incident detection and provide the ability for the logs to be ingested into the Department security information and event management (SIEM) solution.

6. Multifactor Authentication (MFA): The system shall implement multifactor authentication for all access (e.g., users, administrators) to the information system and outlined within a digital identity risk assessment (DIRA).

7. Trusted Internet Connection (TIC) 3.0: The system's external network connections shall adhere to Trusted Internet Connection (TIC) 3.0 guidelines and requirements.

The above requirements must be adequately addressed no later than 30 calendar days prior to planned timeline for the information system to become operational within the ED environment (“go live” date) to allow the Security Assessment Team the necessary time to perform an authorization assessment, collaborate with the necessary security and privacy stakeholders, and ultimately work with the EATI chair/Authorizing Official to issue the initial authorization.

Subtask 7.2: Technical Requirements for System Authorization The Contractor shall adhere to the following technical requirements to ensure comprehensive documentation, security posture, and compliance for all new system authorizations. The Contractor shall have the associated authorization documentation as outlined below completed no later than 90 days after contract award.

7.2.1. System Security Plan (SSP)

The Contractor shall generate (automatically generated from Department GRC Tool) and maintain a System Security Plan (SSP) that meets the following criteria:

• The SSP shall comply with the ED System Security Plan Checklist.

• The SSP shall include a detailed system description and boundary.

• The SSP shall provide a comprehensive hardware list of all components within the system boundary.

• The SSP shall provide a comprehensive software list of all applications and operating systems utilized by the system.

• The SSP shall include a complete ports, protocols, and services list for the system.

• The Contractor shall ensure that control inheritance documented in CSAM accurately aligns with the SSP narratives, system architecture, and defined system boundary (e.g., General Support System (GSS) and/or Cloud Service Provider (CSP) inherited controls).

• The Contractor shall input implementation statements in CSAM for all applicable security controls, including both hybrid and system-specific controls.

• The Contractor shall validate and provide justification for any "Not Applicable" controls or statements set by the user within CSAM.

7.2.2. Agreements

The Contractor shall identify and document all relevant Interconnection Security Agreements (ISAs) and Memorandums of Understanding/Agreements (MOUs/MOAs) pertaining to the new system's interfaces and data exchanges with other systems or entities.

7.2.3. Required Documents

The Contractor shall develop, maintain, and provide the following essential system documentation:

• Incident Response Plan (IRP) o The Contractor shall execute and provide a System Incident Response Test

Report demonstrating the effectiveness of the system's Incident Response Plan.

• Contingency Plan (CP) o The Contractor shall execute and provide the following test reports demonstrating the effectiveness of the system's Contingency Plan:

• System Contingency Plan Test Report

• Disaster Recovery Plan Test Report (if applicable)

• Configuration Management Plan (CMP)

7.2.4. Plan of Action and Milestones (POA&M)

The Contractor shall manage and report on the system's security posture through the following:

• The Contractor shall ensure that a self-assessment is completed and recorded within the Control Validation section of CSAM.

• The Contractor shall ensure that Open POA&Ms are created and maintained in CSAM for all identified deficiencies that are planned for remediation or are not yet in place.

• The Contractor shall provide all necessary Risk Acceptance Packages for any identified risks requiring formal acceptance.

7.2.5. Vulnerability Scan Results

The Contractor shall conduct and provide evidence of timely vulnerability and compliance scanning (every 48 hours or less) for the system's components in accordance with Chief Information Security Officer (CISO) Memo Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks:

• Network and endpoint device vulnerability scan results shall be provided, with scans conducted no more than 30 days prior to authorization activities. Following initial authorization, the system must maintain the capability to perform on-demand vulnerability enumeration and automated scanning, with results provided to the Government within 48 hours of a request.

• Operating system vulnerability scan results shall be provided, with scans conducted no more than 30 days prior to authorization activities. Following initial authorization, the system must maintain the capability to perform on-demand vulnerability enumeration and automated scanning, with results provided to the Government within 48 hours of a request.

The Contractor shall conduct and provide evidence of timely vulnerability and compliance scanning (every 48 hours or less) for the system's components in accordance with the Vulnerability Scan Frequency Requirements outlined in the Information Technology (IT) Risk Assessment (RA) Standard:

• Application vulnerability scan results shall be provided, with scans conducted no more than 30 days prior to authorization activities. Following initial authorization, the system must maintain the capability to perform on-demand vulnerability enumeration and automated scanning, with results provided to the Government within 48 hours of a request.

• Database management system vulnerability scan results shall be provided, with scans conducted no more than 30 days prior to authorization activities. Following initial authorization, the system must maintain the capability to perform on-demand vulnerability enumeration and automated scanning, with results provided to the Government within 48 hours of a request.

7.2.6. Privacy Documentation

The Contractor shall work with the Privacy Office to ensure all necessary privacy documentation is created or modified, as applicable, including:

• Privacy Threshold Analysis (PTA)

• Privacy Impact Assessment (PIA)

• System of Records Notice (SORN)

7.2.7. Document Templates

To facilitate prompt completion of the above requirements in the Department-preferred format, templates for the documentation will be provided at contract award.

7.2.8 Federal Risk and Authorization Management Program (FedRAMP) Requirements (if applicable) For systems leveraging a FedRAMP authorized cloud service offering, the Contractor must understand that FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. While FedRAMP authorization significantly streamlines the security process, it does not represent a full authorization to operate (ATO) within the Department of Education's environment. The Contractor is contractually obligated to thoroughly review and address all customer responsible controls as identified in the associated Customer Responsibility Matrix (CRM) for the specific FedRAMP product being utilized. Simply stating that a system is FedRAMP authorized is insufficient; the Contractor shall document how each customer responsible control is sufficiently implemented and validated for the identified information system, ensuring alignment with Department-specific security policies and requirements. This ensures a complete security posture tailored to ED's operational context and risk appetite.

7.2.9 Technical Requirements for Information Security Continuous Monitoring (ISCM) Upon completion of all technical requirements and initial authorization, the system will transition into the Department's continuous monitoring and security authorization program. This is not the end of the security process, but rather a shift to ongoing oversight. The purpose of this program is to ensure the system maintains its security posture over time, adapting to new threats and vulnerabilities. Continuous monitoring involves regular assessments, vulnerability scanning, compliance scanning, and control validation to confirm that the system remains compliant with all security policies and standards. This proactive approach ensures the system's continued protection of Department data and resources throughout its entire lifecycle.

As part of the OSA Program, the contractor is responsible for the following actions:

1) The information system must maintain its current system configuration throughout the course of the assessment to maintain consistency of assessment results.

a) The SAT must be notified in advance that a configuration change is required during the security assessment activities to permit the appropriate modifications to the overall security assessment schedule.

2) System stakeholders must manage and maintain a list of CSP or GSS leveraged services within the system or technical description and the CSAM software inventory.

3) Information system stakeholders will be available for interviews and information system walkthroughs/demonstrations.

4) Designated information system stakeholders are responsible for requesting all applicable and appropriate authenticated scans (e.g., vulnerability, compliance) on all applicable devices within the authorization boundary (e.g., web applications, databases, servers) as stated within the published Department Standards.

5) All required documents have been appropriately developed, approved, updated, and uploaded as an artifact in CSAM, and attached to the appropriate control(s).

6) The information system ISSO must conduct the “Control Level Review” for each implementation statement within CSAM. The Control Level Review will provide a continuous level of assurance of an information system’s security posture. Each control shall be reviewed the quarter prior to its assessment by the SAT in accordance with the defined motives and published OSA schedule.

Table 8: Deliverables for Task 7

Name

Deliverable Due Date Period of Performance

7.1 Security

Categorization and Information Types (FIPS 199)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.2 Digital Identity

Risk Assessment

(DIRA)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2

Deliverable Due Date Period of Performance

7.3 Technical

Description

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.4 System

Description

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.5 Configuration

Management Plan

(CMP)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.6 Information

System Contingency Plan

(ISCP)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.7 Contingency Plan

Test Results

(CPT)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.8 Incident Response

Plan (IRP)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.9 Incident Response

Plan Test Results

(IRPT)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.10 Disaster Recovery

Plan (DRP)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2

Deliverable Due Date Period of Performance

7.11 Disaster Recovery

Plan Test (DRPT)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.12 Business

Continuity Plan

(BCP)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.13 Business

Continuity Plan Test (BCPT)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.14 Hardware Listing No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated quarterly or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.15 Software Listing No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated quarterly or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.16 Privacy Threshold

Analysis (PTA)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated bi-annually or as requested by the SAOP.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.17 Privacy Impact

Assessment (PIA), if required

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated bi-annually or as requested by the SAOP.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.18 Memoranda of

Understanding

(MOU),

Interconnection Security

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2

5.8 Task 8: Phase-out Support (Optional)

The DR-RUD program requires operational continuity and stability at the time of new contract award. If the Contractor is not awarded the follow-on contract, the Contractor shall aid in the contract transition for a period of up to 90 days before the completion of this contract. The transition period will allow the current Contractor to conduct information sessions with new Contractors and verify that existing processes and procedures are clearly documented and ready for handoff to support a smooth transfer of contract work. The Contractor shall provide materials to the Government that include (but are not limited to): procedures for processing, managing, and disseminating all data products and web services; procedures for administrating software and

Deliverable No.: Deliverable Name

Deliverable Due Date Period of Performance

Agreements (ISAs), Inter- Agency Agreements (IAA), and Service-Level Agreements (SLAs), if required

7.19 Business Impact

Analysis (BIA)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.20 SSP Checklist No later than 30 calendar days prior to

planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4

7.21 Vulnerability

Scans

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then as follows for each type of scan:

• Operating system – Weekly

• Web Application – Monthly

• Database – Monthly

• Infrastructure components –

Monthly

• DHS Cyber Hygiene – as conducted by DHS

Base Period Option Period 1 Option Period 2 server licenses; procedures for updating and maintaining registered web services; procedures for monitoring and maintaining program servers and interactions with IES IT staff; procedures for assessing program analytics; procedures for accessing and administrating all administrative accounts; project and product schedules; procedures and heuristics for managing program databases; and other administrative materials to support a stable transition.

The Contractor (incumbent) shall compile these materials into a phase-out transition plan and make them accessible on a shared workspace to program staff and members of the transition team. The plan shall provide transition support for up to 90 days to the selected contractor if the incumbent contractor is not selected herein. Offerors shall price one option for phase-out support that is not tied to a particular contract period and can be exercised when necessary for transitioning to a new vendor.

Table 9: Deliverable for Task 8

6. Key Personnel/Staff Qualifications Offerors shall propose key personnel they deem most appropriate to complete the tasks outlined in this requirement. After award, the successful vendor will require the consent of IES to replace the project director (or equivalent).

7. Quality Control and Assurance ED shall evaluate the contractor’s performance in accordance with the Quality Assurance Surveillance Plan (QASP; see Attachment 1.A) associated with this procurement. TT

8. Additional ED and Federal-Wide Requirements

8.1 Records and Controlled Unclassified Information (CUI) Requirements

"Federal record" as defined in 44 U.S.C. § 3301, includes all information, made or received by a Federal agency in connection with the transaction of public business. ED owns rights to all records produced as part of this contract. Any Contractor rights must be identified as required by FAR 52.227-11 through FAR 52.227-20.

Deliverable Due Date Period of Performance

8.1 Phase-out Plan No later than 30 calendar days

following government notice of intent not to exercise the next option period or notice of a new contract award.

N/A https://www.archives.gov/about/laws/disposal-of-records.html#def

Federal records must be managed according to the applicable records management laws and regulations, to include the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), 36 CFR Chapter XII Subchapter B, and the Privacy Act of 1974 (5 U.S.C. 552a).

Federal records which are CUI must additionally be managed in accordance with any applicable laws, regulations and government-wide policies (LRGWP) to include EO 13556, 32 CFR Part 2002, ED Directive OCIO 3-113, and NIST-800-171 Revision 2 (or current version).

• Applicability: This clause applies to all Contractors and sub-contractors (hereafter referred to as “Contractors”) and must be incorporated into all subcontracts.

• Training Requirements: All Contractors are required to take the annual Information Management Requirements training. If the contract includes CUI the CUI Identification and Marking Training is required. Additional Category or POC specific trainings may be assigned. Contractor will maintain completion certificates and provide upon request.

• Electronic Information System Requirements: Any electronic information system should address at minimum the following regulations in 36 CFR 1236.10. Agencies must incorporate controls into the system or integrate them into a recordkeeping system that is external to the information system itself (see 36 CFR 1236.20 for recordkeeping system functionalities). Information systems that process, store, or transmit CUI must fulfill the requirements outlined in 32 CFR 2002.14(g).

• Marking Requirements: The Contractor will mark CUI as outlined in Department training.

• Handling and Safeguarding Requirements: The Contractor will ensure that CUI is managed appropriately. The requirements include safeguarding, controlled environments, shipping and mailing or transporting protections, and reproduction protections (see 32 CFR 2002.14(a-e)).

• Contract Completion Requirements: Removal or destruction of records must be in accordance with assigned ED records schedule and must include written concurrence from the CO/COR. If records are removed or destroyed the Contractor must report the incident to ED immediately. Destruction or removal of records without the above requirements is subject to fines and penalties imposed by 18 U.S.C. 2701.

• Compliance with Information Protection Requirements: ED reserves the right to verify compliance with information security requirements established by this contract. The Contractor will fully comply with all ED-initiated inspections as permissible by law.

• Information Security Incidents (ISI) Requirements: Contractors must immediately report any and all suspected security incidents, breaches, and events involving ED information to ED’s Computer Incident Response Center (EDCIRC) email: edcirc@ed.gov, and ED’s…