a MSIX PWS 20221004.pdf

MIGRANT STUDENT

INFORMATION

EXCHANGE (MSIX)

DEVELOPMENT,

MAINTENANCE AND

MONITORING

Attachment A: Performance Work Statement

ABSTRACT

Contractor support services to perform operations, development, maintenance AND monitoring efforts to support the Migrant Student Information

Exchange (MSIX) of Title I, Part C, Migrant

Education Programs (MEP).

Table of Contents

Contents Background

Purpose and Scope

Objectives and Tasks

Task 1: Contract/Project Administration

Task 1.1: Kick‐off Meeting

Task 1.2: Phase‐In and Phase‐Out Periods

Subtask 1.2.1: Phase‐In (Base Year Only)

Subtask 1.2.2: Prepare and Update Phase‐Out Plan

Subtask 1.2.3: Execute Phase‐Out Plan (Optional Task)

Task 1.3: Project Management Support

Task 2: MSIX Operation

Task 2.1: MSIX Administration

Subtask 2.1.1: System Interconnection and Data Ingestion

Subtask 2.1.2: Web Site Administration

Subtask 2.1.3: Fault Problem Detection, Documentation, and Resolution

Subtask 2.1.4: Testing

Subtask 2.1.5: Internet Protocol version 6 (IPv6)

Subtask 2.1.6: Asset Management

Subtask 2.1.7: Disaster Recovery

Task 2.2: IT Systems Security

Sub Task 2.2.1: FISMA Management and Reporting Tools

Sub Task 2.2.2: Privacy Impact Assessment

Task 2.3: MSIX Documentation

Task 3: Customer Support

Task 3.1: MSIX Training and User Support

Task 4: Data Quality (Optional Task)

Task 4.1: Data Analysis, Remediation, and State Engagement (Optional Task)

Task 4.2: Child Count Reconciliation (Optional Task)

Task 4.3: Updating Category 1 and Category 2 Child Count Logic Rules and MSIX Subcategories

Snapshot Methodology (Optional Task)

Subtask 4.3.1: Enhanced Design and Functionality of Child Count Reconciliation Report to Include

Design and Functionality of MSIX Supplement Subcategories Methodology (Optional Task)

Subtask 4.3.2: Viewing of data

Subtask 4.3.3: Examine and export

Task 5: Business Intelligence and Analytics

Task 5.1: License and Software Support

Task 5.2: Reports and Software Support

Subtask 5.2.1: State Profiles (Optional Task)

Subtask 5.2.2: Government Performance and Results Act (GPRA) Reports

Subtask 5.2.3: Child Count Snapshot

Subtask 5.2.4: Dashboard Reports (Optional Task)

Subtask 5.2.5: Web Services (Optional Task)

Task 6: Enhancements (Optional Task)

Task 7: Use of MSIX for Determining MEP Category 1 and Category 2 Child Counts

Task 7.1: Producing the Snapshot for Performance Reporting to the U.S. Department of Education .. 34

Subtask 7.1.1: Child Count Processes and Procedures Paper

Task 8: Virtual Monitoring and Monitoring Technical Assistance to Resolve Corrective Actions (Optional

Task)

Task 8.1 – Monitoring and Monitoring Technical Assistance Protocols (Optional Task)

Task 8.2 – Virtual Monitoring (Optional Task)

Task 8.3 – Compliance Follow‐up and Monitoring Technical Assistance (Optional Task)

Task 9: Usability Studies (Optional Task)

Task 10: System Security Analysis, Remediation Plan and Implementation (Optional Task)

Task 11: Direct Data Entry (Optional Task)

Task 12: Addition of MDEs (Optional Task)

Task 12.1: MDE – MSIX Application Analysis, Development and Deployment

Subtask 12.1.1: Phase 1: Initial Analysis

Subtask 12.1.2: Analysis of Minimum Data Elements

Subtask 12.1.3: Analysis of MSIX Application

Subtask 12.1.4: Requirements Analysis

Subtask 12.1.5: Development and Deployment of New MDE

Other Information

Compliance with Section 508 of the Rehabilitation Act

Documentation Quality

Appendix A: U.S. DEPARTMENT OF EDUCATION INFORMATION MANAGEMENT CONTRACT

REQUIREMENTS

Appendix B: Information Assurance Requirements

Appendix C: Schedule of Deliverables

Appendix D: MSIX Phase Out Plan

Background The educational needs of migratory children present unique challenges for educators and our Nation’s schools. Given the nature of their employment, migratory workers and their families often settle in a single community for a short period of time. One consequence of this mobile lifestyle is that migratory children frequently enroll in new schools and school districts without adequate, and in many cases any, documentation of their educational and health history. School staff at all levels need basic enrollment data, and typically proof of immunizations, to place students in the correct grade or course in a timely manner. Migrant educators have stressed that students in secondary grades have the greatest need for the timely exchange of records because they have limited time to correct mistakes that school officials make if they lack information needed for proper grade placement, course selection, and accrual of course credits required for high school graduation. Because migratory children may move at any time, including during the summer term when many schools are closed, it is imperative to have a reliable system with which the state education agency (SEA), local education agency (LEA), and local operating agency (LOA) staff may access up‐to‐date educational and health information for migratory children in a timely manner. Migrant Education Programs (MEPs) operate throughout the year, including during the summer; having timely access to a migratory child’s educational and health information help ensure that

MEPs can provide migratory children with services that appropriately address their unique needs.

The Migrant Student Information Exchange (MSIX) helps meet the needs of migratory children by making current educational and health information on those children immediately available to school and program staff where migratory children enroll after they move. MSIX uses the Minimum Data

Elements (MDEs) to provide a standard format for information that States must collect and maintain.

MSIX allows SEAs to upload the required MDEs from their own existing State student record systems into a single data repository where information on each migratory child is maintained, organized, and compiled. As a Web‐based platform, MSIX allows authorized users to access a migratory child’s MSIX record via a Web browser.

MSIX, a major information technology (IT) major investment for the Office of Elementary and Secondary

Education, supports the exchange of migrant student records from one school district to another as migratory students move within State or across State lines. This investment is in response to the

Congressional mandate in Section 1308(b) of Elementary and Secondary Education Act of 1965 (ESEA), as amended. Section 1308(b) requires the Secretary to assist States in developing effective methods for electronically exchanging student records amongst States; and, to determine, and accurately account for, the number of migratory children in each State. The MSIX investment consists of a responsive web‐ based platform that links States’ migratory student record databases to facilitate the national exchange of migratory students’ educational and health information. The investment also involves an independent verification and validation (IV&V) effort to ensure correctness and quality of the design, development, and operation of MSIX and related deliverables.

The investment has four goals. These goals include exchanging education and health data; promoting the use of MSIX; ensuring the utilization of the consolidated records for enrollment, placement, and credit accrual, as well as producing national data on the migrant population. The primary beneficiaries of MSIX investments are the migratory students and State MEP grantees. Migratory students benefit from educational records transferred in a timely and accurate manner; available educational records enable students to be quickly enrolled in the correct grade or course or have their secondary course credits accrued towards graduation. MSIX also benefits MEPs by providing data and reporting capabilities on the migratory student population, which supports strategic planning and delivery of

MEP‐funded services.

MSIX will continue achieving programmatic and technical innovation through technical and system enhancements deployed during each option year. The technical and system enhancements are consistent with the requirements of the program office, system security, and emerging technologies.

MSIX was developed as the most cost‐effective method to address the exchange of migratory student records between and amongst States. If MSIX was not in existence, each State would be left to enhance its MEP‐specific database to allow for the national exchange of migratory student records. Furthermore, there would be no national standard for MEP data exchange. Not having a national standard would adversely affect the completeness, logic, and validity of MEP data.

MSIX provides a national MEP record exchange platform providing benefit to internal and external stakeholders. Internal stakeholders include members of the Office of Migrant Education (OME) who can use MSIX to produce national data on the migratory student population. External stakeholders encompass State MEP personnel and migratory families. States MEPs can use MSIX to facilitate enrollment, placement, credit accrual, and participation in the MEP, as well as to produce State‐level data on the migratory student population to support strategic planning and service delivery. Migratory families benefit from this investment, having migratory student records transferred in a timely and accurate manner as they move between and amongst States, which in turn, improves their educational opportunities and academic success.

Purpose and Scope MSIX provides the linkage of 46 States’ MEP‐specific databases for facilitating the national exchange of migratory student records including demographic, educational, and health information for migratory children aged birth through 2 years old, Kindergarten – grade 12 students, as well as out‐of‐school youth through the age of 21. MSIX is built upon Oracle’s COTS Enterprise Edition platform, which utilizes a

Relational Database Management System (RDBMS) in conjunction with a suite of applications. Some of these applications include Oracle Internet Directory (OID), which serves as a Lightweight Directory

Access Protocol (LDAP), Oracle Discoverer, and Oracle Workflow. Also, MSIX uses eScholar’s Unique‐ID student matching engine to identify children individually. MSIX uses State‐supplied data to develop a consolidated migratory student record for each migratory child and provides views of each migratory child’s educational and health record to authorized MSIX users.

Because MSIX is a comprehensive technology platform and a major investment for the U. S. Department of Education (Department), the scope encompasses Contractor support to provide Project Management, System Operations, Cybersecurity Management, Customer Support Help Desk Trouble Ticket

Management and a Password Account Management as outlined in the PWS, Asset Management, State Support and Technical Assistance for MSIX. The MSIX Contractor must provide overall program oversight, analysis, and recommendations to the Department to ensure the quality of the design, development, and operation of MSIX and related deliverables through the Lifecycle Management (LCM) of the program.

The contractor shall perform the following services in providing Operations and Management support during the term of the contract.

Category Services

Help Desk Support • Triage Escalation – Management of trouble tickets requiring technical intervention

• Account management reconfiguration to meet U.S. Department of Education (ED’s) password requirements for multi‐factor authentication

Application

Maintenance

• Applications support services including:

• Analysis of Tickets

• Configuration Management

• Break/Fix Analysis

• Break/Fix Design

• Break/Fix Implementation

• Patch release implementation and testing

• Database optimization Application Development

• Development services for minor enhancements:

• Technical Specifications, Programming, Unit Testing

• Coordinate acceptance testing with the Department of Education

• Promote to Production

• Data Dictionary management

• Provide leadership, resources, and support for scoping ongoing initiatives, including upgrades, new functionality, and subsequent roll‐outs

Application Operations

• Provide operations and/or break/fix support for:

• Developed objects such as Interfaces and Reports

• Batch Jobs

• Release Management

• Version Control

• Change Control Database Management

• Provide database management services including:

• Administration and tuning

• Extent Management

• Monitoring Service Management

• Operate and measure service against Service Level Agreements (SLAs) including:

• Service Level (SL) Target Management

• SL Target Reporting

• Issue Management

• Quality Assurance (QA) Reviews

• Risk Assessments

In meeting these goals, the OME is seeking a contractor to implement all the work outlined in this

Performance Work Statement (PWS) to include coordination to implement the Customer Support component of the MSIX application, as needed, to ensure successful implementation of this contract.

The contractor that is successful in responding to this PWS shall:

a) Ensure the MSIX remains fully functional and stable (e.g. bug‐fixes, security upgrades, software patches), and complete all required system, hardware and software upgrades in a timely manner. Note: all upgrades or enhancements shall be coordinated with the Department.

b) Interface with users and other MSIX personnel on an ongoing basis,. Responsibilities shall include system usage training for users, and rapid response to all technical problems reported to the Contractor by MSIX users, OME, MSIX Help Desk or by MSIX staff.

c) Be expected to install and maintain all MSIX software and hardware components and keep track of them via an automated reporting and tracking tool

d) Seamlessly coordinate on an ongoing basis with the Help Desk Support team for trouble ticket management. Oversee weekly status meetings with OME staff, IV&V team and Customer

Support team.

e) Meet related system security and privacy requirements, including, but not limited to, the transition to a moderate security categorization from a low security categorization which incorporates a solution for a multi‐factor authentication (MFA) log‐in process (utilizing Personal

Identification Verification (PIV) card for internal ED users and an MFA process for external MSIX users).

f) Support the Department’s initiated MSIX staff training initiatives.

g) Adhere to all Federal Government, Department regulations, directives and standards related to the Clinger‐Cohen Act of 1996, Federal Information Security Modernization Act (FISMA), Privacy

Act, Paperwork Reduction Act (PRA), Office of Management and Budget (OMB) Circulars A‐130 and A‐123, among other applicable policies.

h) As needed and necessary to complete the tasks herein, Contractor staff, as determined by ED, will be issued a Government Furnished Laptop (GFE).

Objectives and Tasks The objective of MSIX is to provide a successful electronic system for linking existing State migratory student record systems and electronically exchanging timely and relevant migratory student records to benefit migratory children nationwide. The ability to transfer migratory student records efficiently facilitates the timely enrollment and placement of migratory students by providing better access to basic school enrollment information and their participation in the MEP. An efficient records exchange system benefits highly mobile isecondary‐aged migratory students by providing and maintaining course credit accrual information necessary for high school graduation.

As a student record system, MSIX addresses the unique needs of the mobile migratory child in that it contains the following elements:

a) Matching and identifying unique migratory children. MSIX must correctly identify a unique migratory child from information received from various States’ component systems. MSIX shall establish an effective matching algorithm/logic to ensure a high confidence level that the migratory child is uniquely identified. The matching algorithm/logic must consider common problems when identifying migratory children (e.g. children who use different last names in different States, twins or multiple birth children with the same birth dates and other identifiers, use of common nicknames, inexact dates of birth, etc.)

b) The migratory child’s MSIX consolidated file. The MSIX consolidated file should contain the common information for the unique migratory child that is the same regardless of the child’s previous or current location, and a compiled history of the unique migratory child’s demographic, educational, and health information as represented by the Minimum Data

Element (MDE) record(s) received from one or more State component systems.

c) Matching and merging multiple MDE records for the same child. MSIX shall correctly match and merge multiple MDE records containing educational and health information for the same migratory child to create the MSIX consolidated file. MSIX is likely to receive multiple

MDE records on a child from State component systems around the country. Different State component systems could store records for the same migratory child, given that migratory child had at some point migrated on an inter‐state basis. However, multiple MDE records could theoretically also be collected from a single State component system. This could happen if the State component system has erroneously created and kept a duplicate record for a child.

MSIX must merge the migratory child’s multiple MDE records to create the MSIX consolidated file. The contractor must fully document the decision and business rules for merging MDE records to create the MSIX consolidated file. MSIX must retain a copy of all original MDE records that were consolidated to create the MSIX consolidated file and allow download or drill‐down access to those records upon request by the authorized State or local official.

d) Resolving and reconciling data elements across multiple MDE records for the same migratory child. MSIX must resolve and reconcile data across a migratory child’s MDE record. For example, a State’s component system sends two different MDE records for the same migratory child; the MDE records may cover the same or different time periods, and may contain either conflicting or identical information. The data fields contained within two

MDE records must be resolved and reconciled to arrive at one unique MDE record per State per migratory child.

i. Conflict can occur when multiple MDE records from different state component systems contain data elements that have different values for some of those elements (e.g., both

MDE records contain a birth date element, but the birth date values are different, course credit accrual are different). Examples of reconciliation issues in which the data contained in multiple MDE records would not conflict include:

The MDE records are both partial MDE records and none of the data element definitions are the same; and

The MDE records cover non‐overlapping time periods.

ii. A single State component system sends a migratory child’s MDE record upon initial upload, and then sends changes to a migratory child’s MDE record at a later date.

MSIX must assist States in human resolution of conflicting MDE records. The MSIX data resolution process for conflicting MDE records requires action on the part of the State’s designated Data

Administrator to resolve errors. However, MSIX must facilitate the data resolution process and ease the decision burden for the State Administrator by intelligent error reporting and online error reconciliation decision support. For example, on identical duplicate submissions, MSIX stores one copy of the MDE record and sends a “resolved errors” report back to the State’s component system to help minimize future error submissions. MSIX must provide an online conflict resolution capability to address situations in which multiple MDE records for the same migratory child are identified but it is not clear whether the MDE records are duplicates. For example, in cases where multiple MDE records require further scrutiny prior to being merged, the appropriate State Data Administrator(s) shall be alerted. In other cases, MSIX business rules may require sending a notification alert to State component system designated officials requesting clarification on MDE record contents or confirmation that two MDE records are in fact duplicates.The following overarching objectives are mandated to be accomplished under this contract.

1. Obtain under a performance‐based arrangement, highly reliable and secure IT managed services and support that meets or exceeds customer requirements and expectations.

2. Establish a partner‐focused working relationship with Government.

3. Throughout the life of this effort, demonstrate improved performance, reliability, security, and reduced cost of operating MSIX.

4. Given the dynamics of the IT environment, establish a work order arrangement that easily accommodates change (i.e., implement new and innovative technologies).

5. Develop and implement operation and maintenance services that support the Department’s compliance with Government standards, OMB reporting and Federal requirements [e.g., all

Federal Government directives and standards related to the Clinger‐Cohen Act of 1996, Federal

Information Security Management Act of 2002 (FISMA), Privacy Act, Paperwork Reduction Act

(PRA), Office of Management and Budget (OMB) Circulars A‐130 and A‐123, National Institute of Standards and Technology (NIST)) Special Publications (SP), and Federal Information

Processing Standard (FIPS), among other applicable policies and/or Executive Orders.]

6. Provide a partnership with team members, subcontractors and other prime contractors that appear seamless to the Government and that fosters shared accountability and responsibility among all partners.

7. Provide timely services to enable OME and MSIX to meet its mission‐critical requirements with system down times being as short as possible.

Task 1: Contract/Project Administration

Task 1.1: Kick‐off Meeting Within five (5) calendar days of contract award, of all contract periods, the MSIX Contractor shall conduct a kickoff meeting with the Government to discuss contract objectives and timelines. The MSIX

Contractor shall conduct the kickoff meetingvirtually. . The MSIX Contractor shall provide the meeting agenda and any meeting artifacts (including the initial project plan and timeline, and subsequent meeting minutes).

Deliverable(s)

The Contractor shall create the following documents:

Kick‐off Meeting Agenda (Annual)

Kick‐off Meeting Artifacts – to include project plan and timeline (Annual)

Kick‐off Meeting Notes (Annual)

Task 1.2: Phase‐In and Phase‐Out Periods The MSIX Contractor shall develop comprehensive procedures for the phase‐in and phase‐out of the project and within the time allowed under the terms of this contract. The MSIX Contractor's phase‐in and phase‐out procedures shall not disrupt or adversely impact the day‐to‐day conduct of Government business.

Subtask 1.2.1: Phase‐In (Base Year Only)

During the phase‐in period in the base year, the MSIX Contractor shall prepare to assume full responsibility for all areas of operation in accordance with the terms and conditions of the Phase‐Out

Plan of the current contract, which is expected to end during March 2023. The Phase‐Out Plan of the current contract is provided as Appendix D of the PWS. The MSIX Contractor shall submit a 45 day

Phase‐In Plan to include the bullet points below as well as a description of how all the actions outlined in

Task 1 will be initiated and completed. The Plan shall finalize the MSIX Contractor’s efforts to affect a smooth and orderly implementation of contract responsibility.

During the 45 day phase‐in period, the Contractor shall, at a minimum:

1. Describe procedures for environment transition as outlined in existing Contractor’s Phase‐Out

Plan

2. Obtain all required certifications, licenses, permits, and clearances, including personnel security clearances, if applicable

3. Participate in joint inventories and sign for Government‐Furnished Information (GFI)

4. Continue to develop and submit required deliverables

5. Attend post‐award meetings as required

The contractor shall create the following document:

Phase‐In Plan (submitted during Phase‐In period in base year)

Subtask 1.2.2: Prepare and Update Phase‐Out Plan

A Phase‐Out Plan shall be submitted 90 calendar days prior to the completion of the base period and shall be updated at the request of the Contracting Officer’s Representative (COR). The purpose of the

Phase‐Out Plan is to ensure that the MSIX Contractor is prepared at all times during the life of the contract to facilitate a smooth and orderly transfer of contract responsibility to a successor Contractor, to the Government, or to retire the system. Also, the Phase‐Out Plan shall allow for management personnel of the incoming workforce to observe operations and performance methods of the incumbent

Contractor. The Contractor shall not defer any requirements for the purpose of avoiding responsibility or of transferring such responsibility to the succeeding Contractor. The Contractor shall fully cooperate with the succeeding Contractor and the Government so as not to interfere with their work or duties. The

COR will review the submitted Phase‐Out Plan and make requested changes as needed. The MSIX

Contractor shall update the Phase‐Out Plan in accordance with the COR’s requested changes.

The contractor shall create and update, as required, the following document:

Phase‐Out Plan (90 days prior to completion of base period)

Subtask 1.2.3: Execute Phase‐Out Plan (Optional Task)

If Optional Task 1.2.3 is exercised by the Government, the MSIX Contractor shall execute the phase‐out.

The COR will notify the MSIX Contractor whether the MSIX operations are being transferred to a successor Contractor, whether the MSIX operations are being transferred to the Government, or whether the MSIX system is being retired.

If MSIX operations are being transferred to a successor Contractor or the Government, during this time, management personnel of the incoming workforce or Government may observe operations and performance methods of the incumbent MSIX Contractor. This Phase‐Out Plan will allow for the orderly turnover of equipment and records and will ensure continuity of service. The MSIX Contractor shall not defer any requirements for the purpose of avoiding responsibility or of transferring such responsibility to the succeeding Contractor or Government.

The MSIX Contractor shall fully cooperate with the successor Contractor and the Government to accomplish this task.

If the MSIX system is being retired, all digital information to include contract and system documentation, web pages, and databases and data shall be packaged and delivered to the COR during this time. All software licenses directly paid for by the contract shall be transferred to the Government, and the MSIX Contractor shall properly package and deliver all equipment to the Government (or dispose of it), in accordance with Federal guidelines.

Execute Phase‐Out Plan

Task 1.3: Project Management Support The MSIX Contractor’s project management shall include detailed planning and coordination of contract activities and related technical engineering activities to enable the efficient operations, sustainment, documentation, enhancement, and maintenance of MSIX. This shall be done following an Agile

Methodology framework. The Contractor shall provide project management support to promote the optimal use of Contractor resources, ensure adequate contract performance, and establish management controls to deliver quality services within budget and on time. The Contractor may also be required to provide assistance to the Department in developing strategies to address non‐technical concerns for operating a system that is used nationwide.

Project management shall consist of:

1. Management of the MSIX Contractor’s activities using industry standard project management processes to initiate, plan, execute, control, and close the project in agreement with the Guide to the Project Management Book of Knowledge (PMBOK) which can be found at the following link:

http://www.pmi.org/pmbok‐guide‐standards.

2. Monthly progress reports that include, at a minimum: a brief, factual summary description of operation and maintenance activity and costs incurred for each task (or groups of tasks) during the reporting period, work scheduled for the next reporting period, variances between work scheduled and work performed, issues, risks and proposed corrective actions.

3. Monthly performance reports including performance measurement status as required by this contract and an extract from the risk management repository.

4. Attend Information System Security Officer (ISSO), Quarterly Plan of Action and Milestones

(POA&M), and other security meetings.

5. Oversee and participate in weekly virtual status meetings, , to track the status of MSIX contract deliverables. During these meetings, the MSIX Contractor must provide a weekly status report and briefing on MSIX contract activities.

6. The MSIX Contractor shall develop a Project Management Plan of processes and procedures that demonstrate management controls are in place, used, and quality controls are conducted. The MSIX

Contractor shall deliver the Project Management Plan to the COR for review and approval no later than 15 calendar days after contract award date.

7. Management of daily MSIX operation.

8. Participation and interface with Independent Verification and Validation (IV&V) staff (could be either Government or contracted). The Department plans to retain the services of IV&V support to provide oversight, monitoring, and other IV&V activities. The Contractor shall provide full cooperation with IV&V Contractor and IV&V activities, including making Contractor staff, documentation, and computer code available, upon mutually agreeable dates, for purposes of this activity.

9. Participation and interface with staff that provide information required by the OMB to evaluate

MSIX as a major investment in the Office of Elementary and Secondary Education (OESE). At the minimum the Contractor is required to assist in collecting and submitting performance metrics and other data required for OMB monthly and quarterly updates, the annual Program Assessment, the annual Operational Analysis Report and the Corrective Action Plan for the Program Assessment.

10. The MSIX Contractor shall develop and maintain an Integrated Project Schedule using Microsoft

Project. The Contractor shall deliver the Integrated Project Schedule to the COR for review and approval no later than 20 calendar days after contract award date.

11. The Contractor shall establish baselines and set targets for performance metrics and performance measures utilizing the sample chart of performance metrics provided below. The Contractor shall deliver the Baselines and Targets to the COR for review and approval no later than 30 calendar days after contract award date.

Desired Outcomes

(What are the goals as a result of this contract?)

Required Services

(What task must be accomplished to achieve the desired result?)

Performance

Standard

(What should the standards for completeness, reliability, and quality be?)

Acceptable

Quality Level

(AQL)

(How much error is acceptable?)

(Monitoring

Method)

(How is success defined?)

12. The MSIX Contractor shall establish an electronic project library or create one using the existing

MSIX Program SharePoint Site in the Department’s intranet. As part of this library, the Contractor shall update and create (where necessary) MSIX documents, plans, and deliverables.

13. The MSIX Contractor shall, upon request from the Department, provide advice, recommendations, and strategies to address migrant education concerns.

For major system upgrades or enhancements that include equipment and or software changes, the MSIX

Contractor shall develop and maintain an Integrated Project Schedule. The Project Schedule shall consist of a Microsoft Project file that includes proposed tasks, timelines, and start and finish dates for tasks that apply (i.e. equipment refresh, scheduled software upgrades, enhancements and innovations).

Deliverable(s):

The Contractor shall update (as required) the following documents, which are all defined in the

PMBOK:

Change Management Plan (Annual)

Configuration Management Plan (Annual)

Data Management Plan (Annual)

Personnel and Staffing Plan (Monthly)

Personnel Roster (Quarterly or as needed)

Process Improvement Plan (Annual)

Project Management Plan (Annual, no later than 15 calendar days after award date)

Quality Control Plan (Annual)

Quality Management Plan (Annual)

Requirements Management Plan (Annual)

Requirements Traceability Matrix (As needed)

Risk Management Plan (Annual)

Scope Management Plan (Annual)

System Concept of Operations

System Development Plan(As needed)

System Design Document (As needed)

The Contractor shall create and update (as required) the following documents:

Integrated Project Schedule (Annual, no later than 20 calendar days after award date)

Monthly Status Report (Monthly)

Weekly Status Report (Weekly)

Weekly Status Briefing (Weekly)

Work Breakdown Structure (WBS)(Monthly)

Contractor’s Electronic Project Library or library in the MSIX Program SharePoint Site (As needed)

Task 2: MSIX Operation The MSIX Contractor shall keep the current MSIX fully operational with all existing functionality in accordance with the System Design Document including but not limited to the following tasks:

Task 2.1: MSIX Administration The task includes, but is not limited to:

The Contractor’s information systems shall be developed in accordance with the Department’s

Lifecycle Management Framework (LCM), ACS‐OCIO 1‐106.

Back‐up, restore, and archive files and databases on all MSIX servers;

For planning purposes, the following information relating to the current database applies and is subject to only marginal fluctuation:

o Number of database instances

Production and Disaster Recovery ‐ 6

Non‐production ‐ 13 o Number of tables

Database MSIX Tables All Tables

Grand Total 3,083 38,533 o GB of allocated space

MSIX PROD servers: 40 TB o Technologies

19 Oracle data base 19.10.0.0

9 Oracle WebLogic Server 12.2.1.4

6 Apache HTTP Server 2.4.6

44 Red Hat Enterprise Linux 7.9

2 Elastic Search 6.3

Maintain and optimize standard configurations on all infrastructure components;

Perform installation and configuration of new infrastructure MSIX network and system components;

Upgrade existing hardware and software components of the infrastructure.

Manage storage space on all servers;

Establish and maintain accounts and passwords for all Federal employees, Contractors, and end‐ users that access the MSIX. The Contractor shall use two‐factor authentication per the approved

Homeland Security Presidential Directive 12 (HSPD‐12.) to perform system administration activities;

System administration activities: set thresholds and monitor system for load balancing and system failover issues; ensure system infrastructure scalability for growing user base; implement and monitor failover strategies; monitor best practices for continued system tuning;

Database administration activities : Monitor performance and storage needs as data and user base sizes increase; implement failover and load balancing strategies; fine tune database code for top performance and best practices;

State submission of data must be accomplished via secured File Transfer Protocol (SFTP and

FTPS).

Annual growth in the total number of students added will be minimal, population is approximately 325,000 students. It is expected that the number of records in the database, currently 800 TB of disk space, will increase by 25% a year;

Manage new releases and implementation as they become available. Prepare release notes and updated Test Analysis Reports (TAR) within 10 business days prior to any new release of MSIX software;

Nightly data ingestion for frequency and volume of files loaded (average files received per day:22; Average student records received per day: 7,051; and average number of MDEs received per day 182,574);

Ensure scalability of records to support increases in student and user record volume.

Incorporate a disposition schedule in accordance with the National Archives and Records

Administration (NARA) disposition schedule for MSIX.

Archive student records per the existing MSIX Student Archive and Retrieval process.

Correction of issues or deficiencies in either software or hardware.

MSIX Database Report (Monthly)

Performance Report (Monthly)

Release notes and TAR (as needed, within 10 business days of any new release)

Subtask 2.1.1: System Interconnection and Data Ingestion

In order to achieve the goals of the migratory student record exchange initiative, migratory child data from each State must be loaded into MSIX through systems interconnections between State systems and MSIX. System Interconnection must follow a life‐cycle management approach with an emphasis on security, including planning, establishing, maintaining, and disconnecting the interconnections.

The interconnections must be managed, monitored and secured in compliance with FISMA, OMB Circulars A‐130, and current revision of NIST SP 800‐47: Security Guide for Interconnecting

Information Technology Systems, NIST SP 800‐53 Revision 5: Security and Privacy Controls for

Federal Information Systems and Organizations, and FIPS 200: Minimum Security Requirements for Federal Information and Information. The contractor is responsible for transitioning the

MSIX application from a low security categorization to a moderate security categorization during the base year of the contract in accordance with the schedule set forth by the Security

Assessment Team within the U.S. Department of Education’s Office of the Chief Information

Officer (OCIO) .

State data interfaces will require the completion of Memorandum of Understandings (MOUs) and Interconnection Security Agreements (ISAs). The MOUs define the roles and responsibilities of the participating organizations. The ISAs specify the technical and security requirements of the interconnections. The Contractor is responsible for reviewing the MOU and ISA for each

State and system every year and for working with OME in the renewal process every three years or as needed in accordance to the applicable Federal information security policies.

After the completion of MOUs and ISAs, the interfaces must first be tested to verify that each state can send and receive data effectively to MSIX in the correct format and according to the prescribed procedures. The State Data Ingestion tasks encompass the process to test the state interfaces and load each state’s migrant student data into MSIX. The data is categorized in three phases:

1. Phase I (Demographic and Enrollment data)

2. Phase II (Assessment data)

3. Phase III (Course History data)

The Contractor shall work with States to develop a States’ Assistance Implementation Plan within 90 calendar days after contract award. The Plan will include the courses of action, costs, and 30‐day transition schedule for each State and its vendor to meet statutory requirements to modify their existing MSIX interface to provide the required phases of data (Demographic and

Enrollment, Assessment, Course History). These data are maintained at the local school district level in many states, thus further analysis may be required by state teams and vendors to determine how current interfaces will need to be modified.

The MSIX Contractor shall continue to support the States ingestion process as it currently functions. Each State’s interface transmits demographic, enrollment, assessment and course history data. This involves developmental, testing, and help desk function support.

As States are brought into the MSIX, the Contractor shall test (or retest in the event of changes to a State’s current interface) and certify each State’s interface to validate that it is correctly transmitting all data elements.

The Contractor shall be required to provide new testing and deployment of existing MSIX Web

Services capability. These efforts include testing and facilitation of web services for new states that desire this functionality in accordance with the existing Web Services Onboarding document.

State Data Ingestion Agreements and Data Ingestion Reports ‐ of all states certifying or recertifying data submission interfaces, as well as the submission status of certified interfaces.

The Contractor shall update (as required) the following documents:

States’ Assistance Implementation Plan (Annual, within 90 calendar days of award)

State Data Ingestion Agreements (as needed)

Data Ingestion Reports (Monthly)

Interface Control Document (Annual)

Interface Control Specification (Annual)

MOU and ISA review (Annual, or as needed)

MOU and ISA renewal (Every three years, or as needed)

Inbound Flat File Specifications (As needed)

Outbound Response Flat File Specifications (As needed)

Web Services On‐boarding (Annual)

Subtask 2.1.2: Web Site Administration

The MSIX website is subject to the same conditions expressed on Task 2.1 MSIX Administration. The

MSIX Contractor must be able to make content changes as required by the COR upon approval of the

Change Control Board (CCB) (e.g., change, add, or remove information and documents). The CCB is made up of the Contractor, the IV&V team and the COR. Also, the MSIX website and any modification to existing website must comply with the following:

The Contractor shall ensure that the site complies with OMB Memorandum M‐03‐22 http://www.usa.gov/webcontent/regs_bestpractices/omb_policies/privacy.shtml, which requires the posting of a privacy policy.

MSIX websites must have a “.gov” hostname (typically hostname.ed.gov) is required for all government funded websites under OMB Memorandum M‐05‐04

(http://www.usa.gov/webcontent/regs_bestpractices/omb_policies/domains.shtml).

The Contractor shall ensure that any “ED‐Sponsored” content is identified prominently with

Department of Education, and the ED.gov logo should be displayed prominently and made a link to the ED.gov homepage. The compliance policy is described in the http://www2.ed.gov/internal/wwwstds.html#sponsor.

The Contractor shall ensure that any non‐Federal sponsored websites or content (outside of

.gov, .mil, .Fed.us, etc.) that is linked to complies with “ED.gov” Management and Publishing

Policies” at http://www2.ed.gov/internal/wwwstds.html#link and the OMB Memorandum http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05‐04.pdf.

Compliance with information found at “http://www2.ed.gov/internal/extsite‐tips.html.” must be maintained.

All web and software developed under this work statement will comply with the Section 508 of the “Americans with Disabilities Act” technical standards for web and software accessibility located at 36 CFR 1194.21 and 1194.22. MSIX previously received certification in August 18, 2018.

Subtask 2.1.3: Fault Problem Detection, Documentation, and Resolution

Tasks include:

Monitor the MSIX infrastructure for faults and problems;

Investigate to determine the nature of the fault or problem;

Initiate action to resolve fault or problem and restore the infrastructure to proper operational status and health;

Escalate resolution of the fault or problem according to defined escalation procedures;

Document the fault or problem for the Daily Incident Report and Monthly Incident Status

Report;

o Daily Incident Report ‐ A listing of all “incidents” during the prior 24 hour period shall be produced and if appropriate, provided for review with Government staff. An “incident” is any outage, problem, tasking, or alert of sufficient importance to the integrity of MSIX and its normal operations to merit tracking of the status of the incident to closure. The

Daily Incident Report shall be available for review no later than 9:00 AM local time, Monday through Friday. The Monday report shall list the incidents that occurred Friday morning through the start of business Monday morning.

o Monthly Incident Status Report ‐ This status report shall summarize all of the incidents reported and tracked during the month, and analyze in more detail, by conducting a root cause analysis, the incidents identified by the Government staff as important. The

Monthly Incident Status Report shall serve as a formal record of the description and diagnosis of each incident, the actions taken on each incident, and its final disposition.

This report is due by the 10th business day of the following month.

Network and systems monitoring including, but not limited to:

o Scan error and audit logs for designated infrastructure components;

o Monitor network and system management software for problems, outages, alerts and anomalies affecting the infrastructure, during normal and extended working hours;

o Monitor the performance and capacity utilization of designated infrastructure components;

o Monitor status of fault/problem resolution activities to ensure continuity and to escalate problems as required; and o Conduct a root cause analysis as required for faults/problems as they occur.

Daily Incident Report (As needed)

Monthly Incident Status Report (Monthly)

Subtask 2.1.4: Testing

The Contractor shall provide for the development and implementation of test plans, procedures, and documentation for updated releases, equipment replacement and other changes to components of

MSIX utilizing Agile Methodology. Validation of releases shall include thorough, documented, and successful testing of the system prior to release. The release shall follow a pre‐planned process and shall include the complete agreed‐upon scope, be on time, and within budget. Testing activities including unit, system integration, as well as regression testing, and user acceptance shall be scheduled in advance. Products to be placed under configuration management will be tested by a corresponding testing activity. The Department will conduct independent verification and validation on any changes to the MSIX. Test products (test cases, data, tool, configuration, and criteria), shall be released through configuration management and be documented as part of the Systems Development Life Cycle (SDLC).

Tests shall be described in traceable procedures and have pass‐fail criteria included. Schedule delivery of testing documentation and outcomes in advance and distribute these documents to the COR and their designees.

System and Acceptance Test Plan (Annually)

Development Test Results (As needed)

Development Test Scripts (As needed)

Shakedown Test Results (As needed)

Test Analysis Report (As needed)

Subtask 2.1.5: Internet Protocol version 6 (IPv6)

The Contractor shall provide commercial off‐the‐shelf (COTS) solutions that are IPv6 capable. An IPv6 capable system or product shall be capable of receiving, processing, transmitting and forwarding IPv6 packets or interfacing with other systems and protocols in a similar manner to that of IPv4. Specific criteria to be deemed IPv6 capable are:

An IPv6 Capable system must meet the IPv6 base requirements defined by the USGv6 Profile and testing program.

Systems being developed, procured or acquired shall maintain interoperability with IPv4 systems/capabilities. Systems shall implement IPv4/IPv6 dual‐stack and shall also be built to determine which protocol layer to use depending on the destination host it is attempting to communicate with or establish a socket with.

If either protocol is possible, systems shall employ IPv6. The Contractor shall provide IPv6 technical support for system development, implementation, and management.

Subtask 2.1.6: Asset Management

The Contractor shall provide a full range of Asset Management Support including, but not limited to:

Receipt of any software licenses or certificates from the Department that may need to be obtained; Shipment of Automated Data Processing (ADP) assets, including coordination with shipping and receiving departments to ship and track inventory assets;

If necessary, the transition of any licenses or certificates to the Government or designated individual which may include another Contractor;

Providing a report listing updates to existing assets every 6 months; and

Software inventory document must include: Name, Software Function, Software Classification, Environment, Serial/License Number, Asset Tag, Description, End of support date, End of life date, Version, Manufacturer Name

Government furnished PIV cards

The Contractor is responsible for ensuring adequate staffing for scheduling, performance, and reporting of these assigned tasks. A current list of assets is included in the Appendices to this PWS.

The Contractor shall update (as required) the following document:

Asset Management Report (every 6 months)

Subtask 2.1.7: Disaster Recovery

MSIX development, test, and production environments are hosted in Amazon Web Services – East located in Northern Virginia. The MSIX disaster recovery environment and access points are hosted in

Amazon Web Services – West located in California. Due to security reasons, exact locations are not disclosed by Amazon.

During the first 90 calendar days after contract award, the Contractor must implement a disaster/training hosting solution separate from the location of the production facility that best addresses MSIX needs regarding cost, efficiency, and innovation, taking into consideration all relevant costs including equipment, labor, and facilities. The Contractor may continue operation through Amazon

Web Services provider or choose another location. At the end of 90 calendar days, full functionality should be in place.

The Contractor shall provide additional operations and maintenance activities to support the dedicated training environment and disaster recovery. The Contractor shall provide the labor and materials necessary to maintain full certification and continued accreditation of the separate facility and the full replication of the production site – including the loading of live data‐‐ at this separate facility.

The Contractor shall develop and update (as required) the following documents:

Contingency Plan (Annual)

Disaster Recovery Plan (Annual)

Task 2.2: IT Systems Security The Contractor and all subcontractors shall comply with…