Attachment_1_-_PWS.pdf

Performance Work Statement (PWS)

1. Background

The Bureau of Indian Education (BIE) Family and Child Education (FACE) and Early Childhood Programs currently utilize Power BI, SharePoint, and FormAssembly to collect, manage, and report data on prekindergarten, adult education, and family engagement. These existing systems require integration and modernization to improve efficiency, reduce duplication, and strengthen data quality.

BIE also oversees annual child count data collection for Early Childhood intervention programs, which must align with federal reporting requirements and expectations. The Contractor shall design, develop, and maintain a cloud-based Software as a Service (SaaS) solution hosted within a FedRAMP-authorized environment. The solution shall comply with all applicable federal IT security and privacy policies and standards, including FedRAMP, FISMA, NIST, and Section 508.

The system shall not be hosted, maintained, or managed on internal BIE infrastructure and must be fully vendor-supported. The Contractor shall provide ongoing educational data analyses, including mid-year and end-of-year reporting, to support program accountability, data validation, and decision-making. The system shall be capable of producing accurate, reliable, and auditable data to meet federal oversight and reporting requirements.

2. Purpose

The Bureau of Indian Education (BIE) requires a qualified contractor to manage, enhance, and potentially transition the Family and Child Education (FACE) and Early Childhood Programs Support Services data systems. The contractor will provide comprehensive technical, operational, analytical, and compliance support to BIE, sites operating FACE and Early Childhood Programs, and contracted partners to ensure continuity, security, and scalability of services.

This includes delivering and maintaining a cloud-based Software as a Service (SaaS) solution hosted within a FedRAMP-authorized environment, ensuring compliance with federal IT security and privacy standards, and providing ongoing educational data analyses (such as mid-year and end-of-year reporting). These services will directly support program growth, flexibility, accountability, federal reporting, and data-driven decision-making.

3. Scope

The scope of this requirement is to provide comprehensive support for the Bureau of Indian Education’s (BIE) Family and Child Education (FACE) and Early Childhood Programs data systems.

The Contractor shall deliver a secure, modernized, and scalable cloud-based Software as a Service (SaaS) platform hosted within a FedRAMP-authorized environment to support

2 | P a g e Educational Support Services Family and Child Education (FACE) and Early Childhood Programs data collection, management, analytics, and reporting across more than 50 sites operating FACE and Early Childhood Programs.

The Contractor shall provide:

• Ongoing system management and vendor support, as the platform is externally hosted and not maintained or supported by BIE IT staff.

• Daily technical assistance and helpdesk support to sites implementing FACE and Early Childhood Programs, including onboarding, access management, troubleshooting, and user training.

• Continuous customization and enhancement of the platform to align with evolving FACE and Early Childhood Program requirements, data elements, and compliance rules across both Bureau-Operated Schools (BOS) and Tribally Controlled Schools (TCS).

• Comprehensive analytics and reporting, including real-time dashboards, on-demand reporting for BIE leadership, DOI, or Congressional requests, mid-year and end-of-year site-level analyses, aggregated program performance evaluations, data validity and reliability checks, and federal reporting deliverables.

• Compliance assurance to ensure the system and its outputs meet all applicable federal cybersecurity and privacy requirements (FedRAMP, FISMA, NIST, Section 508).

These services are critical to support FACE and Early Childhood Program accountability, determine site funding eligibility, and ensure uninterrupted service delivery to children and families.

4. Objectives

The Contractor shall support the creation, enhancement, and ongoing operation of a unified data system for the Bureau of Indian Education’s (BIE) Family and Child Education (FACE) and Early Childhood Programs. The system shall collect, manage, and report accurate data to support decision-making, funding accountability, federal reporting, and continuous program improvement.

To achieve this, the Contractor shall:

• Design, develop, and maintain a unified data system (a single platform that integrates all FACE and Early Childhood Program components into one central system) that supports data collection, management, analytics, and reporting across Prekindergarten, Adult Education, Family Engagement, and Early Childhood Program Child Count.

• Apply human-centered design principles (an approach that prioritizes the needs, usability, accessibility, and experience of end users throughout the design and development process) to ensure the system is intuitive and effective for staff at more than 50 FACE and Early Childhood Program sites.

3 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

• Utilize modular design architecture (a structure built from independent, interchangeable modules, such as Prekindergarten, Adult Education, Family Engagement, and Child Count that can be added, removed, or updated without disrupting other system components) to allow for flexible updates and expansion as programs evolve.

• Follow best practices for secure cloud-based development and scalable architecture (including hosting in a FedRAMP-authorized environment, applying FISMA and NIST security controls, and designing to support growth in users, sites, and data volume without major redevelopment) to ensure the system remains reliable, secure, and adaptable.

• Continuously incorporate user feedback and evolving program requirements (through ongoing engagement with BIE, site staff, and contracted partners) to keep the system aligned with current policies, practices, data elements, and reporting requirements.

• Provide timely and accurate educational data analyses and reporting (including mid-year site-level analyses, end-of-year evaluations, data validity and reliability checks, and aggregated program performance reporting) to inform funding allocations, site-level supports, and federal accountability reporting.

5. Performance Requirements

The Contractor shall provide all services, deliverables, and support described in this section to operate, enhance, and sustain the Bureau of Indian Education’s (BIE) Family and Child Education (FACE) and Early Childhood Program data systems. All cloud-based services shall be delivered in a FedRAMP-authorized Software as a Service (SaaS) environment (a cloud-hosted system approved for federal use under the Federal Risk and Authorization Management Program), meet all applicable federal security and privacy requirements, and obtain or maintain an Authority to Operate (ATO) or Authority to Use (ATU) as required by the Department of the Interior (DOI).

5.1 System Management and Oversight

• Manage and oversee the existing FACE and Early Childhood Program data systems end-to-end, including infrastructure, operations, performance, and user access.

• Host and operate the platform in a FedRAMP-authorized cloud environment (a secure, federally authorized hosting environment) with full vendor responsibility for all hosting, maintenance, updates, patching, and security.

• Coordinate and implement system updates across Power BI (data visualization and analytics platform), FormAssembly (form-building and data collection tool), and SharePoint (content and document management system) to ensure continuity and stability.

• Develop and maintain a Portal Management Plan (a documented plan that defines system governance structures, user roles and permissions, access control, incident escalation workflows, and disaster recovery procedures).

4 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

• Provide monthly operational status reports summarizing uptime, incidents, security events, and resolution timelines.

Performance Standard: Systems operate without disruption and maintain 92% uptime during core hours (Monday–Friday, 7:00 AM–4:00 PM local time, excluding federal holidays, during the 8-month school year).

5.2 System Development and Improvement

• Design and implement enhancements to improve usability, performance, accessibility, and data integrity using a formal change management process (a documented process requiring COR approval prior to implementation of system changes).

• Propose and execute modernization strategies (efforts to consolidate existing systems into newer technologies, such as transitioning from multiple standalone tools into a unified FedRAMP-authorized SaaS platform like Power Apps).

• Incorporate modular design architecture (a structure built from independent, interchangeable modules—such as Prekindergarten, Adult Education, Family Engagement, and Child Count—that can be updated or replaced without affecting other modules).

• Provide version release notes, updated system documentation, and training on all major enhancements.

Performance Standard: Enhancements meet requirements, receive COR approval, and are deployed on schedule with zero critical errors during core operational hours (Monday– Friday, 7:00 AM–4:00 PM local time, excluding federal holidays).

5.3 Data Integration and Continuity

• Maintain Power BI dashboards (interactive reports that display live program data) and SharePoint infrastructure (site libraries and permissions used for document management and data storage).

• Enable migration and integration of historical data (moving legacy data into the new unified system while preserving integrity).

• Implement automated data quality checks (rules to verify accuracy and completeness), version control (tracking changes to data and system configurations), and backup/recovery protocols (regular data backups and documented recovery procedures).

• Ensure secure data storage, export functionality, and audit readiness (ability to provide full documentation and data history on demand).

Performance Standard: 98% of required data is complete, accurate, and available by reporting deadlines.

5 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

5.4 Flexibility and User Engagement

• Provide tools and training for authorized users to request system updates (such as new forms, fields, or workflows).

• Conduct annual user feedback surveys (structured surveys sent to all site users) and incorporate findings into planned releases.

• Maintain a change log (a centralized record of user requests, approval dates, and implementation status).

Performance Standard: 95% of approved user-requested updates are implemented within 30 calendar days without disrupting reporting schedules.

5.5 Pilot Testing and Deployment

• Conduct structured pilot testing (testing major changes with a small group of 3–5 sites before systemwide release).

• Collect pilot feedback, resolve identified issues, and submit a pilot results report to the COR.

• Deploy approved updates to all sites after pilot approval.

Performance Standard: Pilots achieve at least 90% functionality success before full rollout.

5.6 Technical Assistance and Training

• Provide daily helpdesk support (real-time user assistance for troubleshooting, onboarding, and access management) during core hours (7:00 AM–4:00 PM local time, M–F, excluding federal holidays).

• Host monthly virtual office hours (scheduled Q&A sessions with system experts) and respond to helpdesk tickets within two business days.

• Deliver at least three annual virtual trainings (web-based group sessions) and one in-person training aligned to FACE leadership meetings.

• Maintain current user guides, SOPs, and a knowledge base (online library of instructions and troubleshooting resources).

Performance Standard: 95% satisfaction rate from post-training evaluations and TA surveys for services delivered during core hours.

5.7 Early Childhood Program Data Collection Support

• Develop and maintain secure, accessible tools for annual Early Childhood Program child count data collection (the federally required annual count of children receiving services).

• Provide step-by-step guidance, data dictionaries, and templates for sites and Tribal partners.

• Conduct pre-collection webinars and post-submission data validation checks.

6 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

Performance Standard: 100% of sites submit complete and timely child count data; error rate under 2%.

5.8 Site Accountability and Compliance Support

• Develop internal audit tools (checklists and documentation trackers), compliance dashboards (live status indicators), and site readiness reports to support monitoring.

• Train sites on documentation protocols, data integrity, and audit preparation.

• Provide compliance readiness summaries to BIE leadership.

• Produce custom data reports and analyses on demand for BIE leadership, DOI, or

Congressional inquiries, using validated data from the FACE and Early Childhood Program systems.

Performance Standard: 100% of sites demonstrate documentation readiness in mock audits.

5.9 Scalability and Expansion

• Design all systems to be modular and scalable (able to support growth in sites, users, and data without major redevelopment).

• Provide capacity planning (forecasts of needed resources), load testing (simulated high-usage testing), performance monitoring, and a 5–10 year growth roadmap.

• Build architecture to support future integration with federal reporting systems, APIs, and new data sources.

Performance Standard: Platforms scale to support growth with 95% operational performance during core hours (Monday–Friday, 7:00 AM–4:00 PM local time, excluding federal holidays).

5.10 Cybersecurity and Privacy Compliance

• Operate within a FedRAMP-authorized SaaS environment.

• Comply with FISMA (Federal Information Security Modernization Act), NIST SP

800-53 (federal security control standards), and DOI IT Cybersecurity and Privacy Control Standards.

• Obtain and maintain a valid Authority to Operate (ATO) or Authority to Use

(ATU).

• Protect Controlled Unclassified Information (CUI) and Personally Identifiable Information (PII) with FIPS 140-validated encryption (federally approved data encryption standard).

• Implement zero trust architecture (a security model requiring verification for all users) and continuous monitoring (vulnerability scans, patching, log review, and incident response).

• Maintain Section 508 compliance (ensuring ICT is accessible to individuals with disabilities).

7 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

Performance Standard: 100% adherence to federal security and privacy requirements with no critical findings during security reviews or audits.

6. Deliverables

The Contractor shall provide the following deliverables to support the Bureau of Indian Education’s (BIE) Family and Child Education (FACE) and Early Childhood Program data systems.

All deliverables shall be submitted in electronic format (Microsoft Office or PDF unless otherwise specified) to the Contracting Officer’s Representative (COR). All deliverables must support operation in a FedRAMP-authorized Software as a Service (SaaS) environment (a secure cloud-hosted system approved for federal use) and comply with FISMA (Federal Information Security Modernization Act), NIST SP 800-53 (federal security controls), DOI IT Privacy and Cybersecurity Standards, the Privacy Act, and Section 508 (accessibility for individuals with disabilities).

# Deliverable Description Due Date / Frequency

6.1 Project Workplan

A milestone schedule showing all tasks, dependencies, and assumption of system responsibilities. (Defines who does what and when.)

Within 15 days of award

6.2 System Design Documents

Architecture diagrams, data flows, workflows, platform mapping, and proposed enhancements.

(Includes cloud hosting model, FedRAMP SaaS environment, modular design, APIs.)

Within 30 days of award;

updated with major releases

6.3 Portal Management Plan

A detailed operational plan describing system governance, user roles/permissions, access controls, incident escalation workflows, and disaster recovery procedures. (Shows how the system will be run day-to-day.)

Within 45 days of award;

updated annually

6.4 Functional System

A fully operational platform supporting current data needs using Power BI (data visualization), FormAssembly (form/data collection), and SharePoint (document/content management). (All components must be live and accessible to users.)

Within 60 days of award

6.5 Cybersecurity & Privacy Plan

Documentation showing compliance with FISMA, FedRAMP, NIST, DOI privacy standards, and Section 508. (Describes how security, privacy, and accessibility requirements will be met.)

Within 60 days of award;

updated annually

8 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

# Deliverable Description Due Date / Frequency

6.6 Data Migration Report

Verification that all historical data was migrated successfully and passed functional testing.

(Includes validation results and error resolution logs.)

Within 75 days of award

6.7 Modernization Strategy Roadmap

An assessment of current tools and recommendations for modernization (e.g., migration to a unified FedRAMP SaaS platform) including cost, timeline, and risk mitigation.

(Provides the forward plan for future system upgrades.)

Within 80 days of award;

updated annually

6.8

Pilot Implementation Plan & Results Report

Plan for pilot testing with 3–5 sites, plus a results report showing feedback, issues found, and corrective actions. (Ensures functionality before full deployment.)

Plan by day 60; results by day 90

6.9 Full Deployment Certification

Documentation confirming the system is fully deployed to all sites, operational, and that all users are onboarded and trained.

Within 120 days of award

6.10 Training Package

Final training materials including user guides, SOPs (standard operating procedures), quick reference guides, and online knowledge base content. (Ensures consistent user training.)

Within 120 days of award; update as changes occur

6.11 Training Delivery

Delivery of at least 3 annual virtual trainings (live web-based sessions) and 1 in-person training aligned to FACE leadership meetings, with attendance logs and evaluations.

Annually

6.12 Early Childhood Program Data Support Plan

A plan for the annual child count (federally required count of children receiving services), including data templates, validation procedures, and reporting process.

Within 90 days of award;

updated annually

6.13 Data Quality & Continuity Plan

Plan describing automated data quality checks (rules to verify accuracy), version control (change tracking), backup/recovery procedures, and audit readiness.

Within 90 days of award;

updated annually

6.14 System Scalability & Growth Plan

Plan showing how the platform will scale to support more sites, users, and program components

Within 120 days of award; updated annually

9 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

# Deliverable Description Due Date / Frequency without major redevelopment. (Includes load testing and a 5–10 year growth roadmap.)

6.15 Monthly Operational Status Reports

Reports showing system uptime, outages, incident resolution times, and helpdesk metrics.

Monthly (by the 10th)

6.16 Change Management Log

Log of all system change requests, COR approvals, testing, deployments, and version release dates.

(Documents the change control process.)

Updated continuously;

submitted quarterly

6.17 Helpdesk Support Reports

Summary of helpdesk tickets, resolution times, user satisfaction scores, and recurring issues.

Quarterly

6.18 User Feedback Survey Results

Survey instrument, analysis, and list of system enhancements made based on user feedback.

Annually

6.19 Compliance Dashboards & Audit Tools

Interactive dashboards showing site readiness plus downloadable site-level mock audit checklists and documentation trackers.

Initial within 180 days;

updated quarterly

6.20 Educational Data Analytics Reports

Mid-year and end-of-year site-level analyses, aggregated program outcome reports, and data validity/reliability verification logs. On-demand reporting for BIE leadership, DOI, or Congressional requests.

Mid-year (by Feb 15) and end-of-year (by Aug

15) annually: As requested

6.21 Annual Evaluation Report

Consolidated report summarizing overall program performance and outcomes across all sites.

Annually (60 days after program year-end)

6.22 Security & Privacy Compliance Documentation

ATO/ATU status letters, vulnerability scan results, patch logs, user access control lists, encryption validation, and Section 508 conformance reports.

(Shows federal authorization to operate.)

Initial within 60 days;

updated quarterly and as requested

6.23 System Data Schema & Data Dictionary

A complete export of the system’s data schema (database structure, field names, relationships, and metadata) and a plain-language data dictionary for each module. (Allows BIE to rebuild, migrate, or recover the system if vendor services end or the site goes down.)

Within 90 days of award;

updated with any structural changes

10 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

# Deliverable Description Due Date / Frequency

6.24 Ad Hoc Reporting Functionality & User Guide

A built-in reporting feature that allows authorized end users to create custom reports (select fields, filters, date ranges, and export formats) without developer support, along with user instructions.

(Gives BIE and site staff on-demand reporting flexibility.)

Delivered as part of the full system (by day 120) and maintained throughout the period of performance

7. Place of Performance

Primary Place of Performance:

All work shall be performed remotely from the Contractor’s facilities.

System Hosting Environment:

The FACE and Early Childhood Program data platform shall be hosted in a FedRAMP-authorized Software as a Service (SaaS) cloud environment, managed entirely by the Contractor. The system shall not be hosted, maintained, or supported on internal BIE infrastructure.

Government-Site Activities:

• The Contractor shall travel to BIE-designated locations as required to conduct:

o In-person trainings (minimum one annually, aligned with FACE leadership meetings) o Pilot testing activities at selected FACE and Early Childhood Program sites o On-site technical support or data collection support if requested by the

COR

• Specific travel locations and dates will be coordinated and approved in advance by the COR.

Work Hours:

The Contractor shall provide system support, helpdesk assistance, and operational monitoring during core business hours of Monday–Friday, 7:00 AM–4:00 PM local time across all U.S. time zones, excluding federal holidays, to align with school operational schedules.

8. Government-Furnished Information and Equipment

The Government will provide the Contractor with the information and resources necessary to support the Family and Child Education (FACE) and Early Childhood Program data systems. Because this work may involve a transition from an incumbent

11 | P a g e

Family and Child Education (FACE) and Early Childhood Programs contractor to a new contractor, all Government-furnished information shall include complete system and operational documentation to ensure continuity of services.

8.1 Government-Furnished Information (GFI)

Upon award, the Government shall provide the Contractor with the following:

• Full operational documentation and transition package from the incumbent contractor, including:

o Complete system data schema and data dictionary o Current system architecture diagrams, workflows, and integration maps o Administrative credentials for all system environments (Power BI, SharePoint, FormAssembly, and any other hosted components) o Source documentation for any custom-built modules or code components o User account lists and access control structures o Existing change management and version history logs

• Copies of all current and historical program data, reports, and analytics outputs

• Existing training materials, SOPs, and branding/visual identity standards

• BIE policies, procedures, and technical requirements applicable to the FACE and

Early Childhood Program data systems

• Points of contact at the BIE central office and participating FACE and Early

Childhood Program sites

This GFI is being provided to ensure that the new Contractor can assume system responsibilities without disruption to services.

8.2 Government-Furnished Equipment (GFE)

The Government does not anticipate providing Government-Furnished Equipment (GFE) for this requirement. The Contractor shall use its own hardware, software, development environments, and collaboration tools to complete all work, unless otherwise approved in writing by the COR.

If GFE is provided at any point during the period of performance, the Government will issue a written modification identifying the specific items, conditions of use, and return requirements. The Contractor shall be responsible for safeguarding and maintaining any GFE issued.

9. Contractor-Furnished Items and Responsibilities

The Contractor shall furnish all personnel, labor, materials, supplies, equipment, software licenses, cloud hosting environments, and other resources not expressly identified as Government-furnished in Section 8.

9.1 Personnel Suitability and Background Investigations

12 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

• All contractor personnel assigned to this requirement who will have access to Government systems, data, or FACE and Early Childhood Program sites shall:

o Successfully pass a Tier 1 (National Agency Check with Inquiries — NACI) or equivalent background investigation, o Submit all required personnel security forms and fingerprints as directed by the Bureau of Indian Education (BIE) Personnel Security Office, and o Receive favorable adjudication prior to performing work.

• The Contractor shall ensure no personnel begin work or are granted access to

Government systems or school premises until the required background investigation is complete and favorably adjudicated.

• The Contractor shall immediately notify the COR of any personnel changes and initiate required background checks for replacement staff.

9.2 Personnel – Skills and Knowledge

The Contractor shall provide personnel with the necessary skills and expertise to perform all work required under this contract. Contractor personnel shall collectively demonstrate:

• Experience with federal education program data systems, particularly early childhood and special education systems

• Expertise in cloud platform administration (Power BI, SharePoint, FormAssembly, and Power Apps)

• Knowledge of data security, FedRAMP/FISMA/NIST compliance, and Section 508 accessibility standards

• Proficiency in educational statistics, data analytics, dashboards, and reporting

• Experience delivering technical assistance and training to diverse user groups, including Tribal communities and school-based staff

9.3 Travel

Pre-Travel Approval The contractor will require travel to support requirements outlined in said agreement. Travel arrangement shall have authorization or prior approval, in accordance with Federal Travel Regulations (FTR) 41 C.F.R. § 301-2.1. All travel requests shall be submitted to the Contracting Officer Representative (COR) to ensure the proposed travel meets FTR requirements and reasonable cost, per 41 C.F.R § 301-2.3, before approving travel request. The COR’s approval is to ensure travel supports mission requirements/is essential to advancing the services for this Project. Travel costs that are projected to exceed standard federal travel rates shall be requested and approved in writing by the COR prior to incurring the cost.

Post-Travel Approval Once travel is completed the reimbursement request shall be submitted to the COR for approval, prior to the final submission to the IPP. The reimbursement request shall include but is not limited to the following: traveler name, travel itinerary, purpose for travel, travel receipts (hotel, rental car, gas), tax statement, etc., per 41 C.F.R. § 301-2.2. The COR’s review shall ensure travel

13 | P a g e

Family and Child Education (FACE) and Early Childhood Programs meets FTR requirements and reasonable cost before travel reimbursement is submitted to IPP for final payment. For further information on Travel Costs, see FAR 31.205-46. All changes to an already approved travel (i.e., changes for an early return) shall be re-approved by the COR to ensure costs are advantageous for the Government. The traveler shall be responsible for all expenses incurred that are over the allowable reimbursement limits established in the FTR, e.g., all excess costs resulting from circuitous routes, delays, or luxury accommodations or services unnecessary or unjustified in the performance of official business, per 41 C.F.R. § 301-2.4.

Travel costs shall not incur any general and administrative (G&A) and/or profit costs. Travel costs shall be reimbursed using actual cost incurred.

9.4 Contractor-Supplied Infrastructure

The Contractor shall provide and maintain all infrastructure, hardware, software, cloud environments, and related resources necessary to perform the work under this contract.

The Government will not provide any hosting or technical infrastructure.

Contractor responsibilities shall include, at a minimum:

• Cloud Hosting Environment o Provide and manage a secure FedRAMP-authorized Software as a Service

(SaaS) cloud environment for hosting the FACE and Early Childhood Program data platform.

o Ensure the environment meets all applicable federal security, privacy, and accessibility standards (FISMA, NIST SP 800-53, DOI IT Security, Privacy Act, Section 508).

• Software Licenses o Procure and maintain all software licenses, subscriptions, and user access required to operate the platform and its components, including but not limited to Power BI, SharePoint, FormAssembly, and Power Apps.

o Ensure licenses remain active and compliant for the duration of the contract.

• Development and Testing Environments o Maintain separate development, testing, and production environments for system updates.

o Implement version control and change management processes to prevent disruption to live operations.

• Hardware and Connectivity o Provide all computers, servers, network connectivity, and security tools needed by contractor personnel to perform the work.

o Maintain endpoint security tools (firewalls, antivirus, patching, encryption) for all devices accessing Government data.

• Data Protection and Continuity

14 | P a g e

Family and Child Education (FACE) and Early Childhood Programs o Provide automated backup and recovery systems, vulnerability scanning tools, and monitoring systems to ensure system availability, continuity, and integrity.

o Immediately report any incidents, outages, or security events to the COR in accordance with DOI IT Security requirements.

10. Security Requirements

The Contractor shall be fully responsible for ensuring that all information systems, environments, and activities supporting the Family and Child Education (FACE) and Early Childhood Program data systems comply with applicable federal cybersecurity and privacy requirements.

10.1 Federal Security Standards

The Contractor shall:

• Host the FACE and Early Childhood Program data platform in a FedRAMP-authorized Software as a Service (SaaS) cloud environment approved for federal use.

• Comply with the following federal security and privacy standards at all times:

o FISMA (Federal Information Security Modernization Act) o NIST SP 800-53 security and privacy controls o NIST SP 800-37 Risk Management Framework (RMF) o Privacy Act of 1974 o DOI IT Security and Privacy Control Standards o Section 508 of the Rehabilitation Act (accessibility for individuals with disabilities)

• Protect all Controlled Unclassified Information (CUI) and Personally Identifiable

Information (PII) handled under this contract.

10.2 Authority to Operate (ATO)

• The Contractor shall obtain and maintain an active Authority to Operate (ATO) or Authority to Use (ATU) issued by the Department of the Interior (DOI) for the platform throughout the period of performance.

• The Contractor shall provide the Government with all required documentation to support security authorization activities, including:

o System Security Plan (SSP) o Security Assessment Plan (SAP) and Security Assessment Report (SAR) o Plan of Actions and Milestones (POA&M)

• The Contractor shall immediately report any changes that could affect the system’s security posture.

10.3 Access Control and User Management

15 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

• The Contractor shall implement role-based access control (RBAC) and least-privilege principles for all system users.

• The Contractor shall maintain and submit current user access control lists (ACLs) to the COR on a quarterly basis.

• The Contractor shall promptly revoke access for separated or unauthorized users and notify the COR of changes.

• Multifactor authentication (MFA) shall be enforced for all administrative accounts.

10.4 Data Security and Encryption

• All data at rest and in transit shall be protected using FIPS 140-validated encryption.

• All backup copies shall be encrypted, protected from unauthorized access, and stored in compliance with federal records retention policies.

• The Contractor shall prevent unauthorized disclosure, modification, or destruction of Government data and ensure integrity and availability at all times.

10.5 Monitoring, Incident Response, and Reporting

• The Contractor shall implement continuous monitoring of the platform, including:

o Vulnerability scanning o Security patching o Log collection and review o Intrusion detection

• The Contractor shall develop and follow a Cybersecurity Incident Response Plan

(CIRP).

• Any suspected or confirmed data breaches, security incidents, or unauthorized access shall be reported to the COR and DOI IT Security within one (1) hour of discovery.

10.6 Physical and Personnel Security

• All contractor personnel with access to Government data or systems shall have a favorably adjudicated Tier 1 (NACI) background investigation before beginning work.

• The Contractor shall ensure that all personnel safeguard all Government-furnished data and information in accordance with federal security policies.

10.7 Mandatory Security and Privacy Training (if applicable)

• All contractor personnel with access to Government systems, networks, or data shall complete Department of the Interior (DOI)-required security and privacy awareness training prior to receiving system access and annually thereafter.

• The Contractor shall maintain records of completion and provide proof of training to the COR upon request.

16 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

• Personnel who fail to complete annual training shall have their system access suspended until training is completed.

11. Privacy and Data Ownership

11.1 Data Ownership

• All data, content, materials, and intellectual property created, collected, processed, or maintained under this contract are and shall remain the sole property of the Bureau of Indian Education (BIE).

• The Contractor shall have no ownership, license, or other rights to any Government data or materials beyond those necessary to perform the contract.

• This includes, but is not limited to:

o Student, family, and personnel records o Site-level and aggregate program data o Data schemas, data dictionaries, and system configurations o Dashboards, analytics, reports, and visualizations o Forms, templates, training materials, SOPs, and user documentation

11.2 Privacy Protections

• The Contractor shall treat all data as confidential and protected under applicable federal privacy laws, including the Privacy Act of 1974, FERPA (Family Educational Rights and Privacy Act), and DOI IT Security and Privacy Control Standards.

• The Contractor shall:

o Implement safeguards to prevent unauthorized disclosure or use of

Personally Identifiable Information (PII) and Controlled Unclassified Information (CUI) o Restrict access only to authorized contractor and Government personnel who have a legitimate need to know o Ensure that all personnel complete required privacy and security training before accessing Government systems or data

11.3 Return and Destruction of Data

• Upon completion or termination of this contract, the Contractor shall:

o Return all Government data and materials in a Government-approved format and location specified by the COR o Provide the complete system data schema and data dictionary to support future Government use or migration o Certify in writing that no copies, backups, or residual data remain in the

Contractor’s possession or on any contractor-controlled systems

• The Contractor shall cooperate fully with the COR to ensure orderly transition of all data and documentation to the Government or to a follow-on contractor without disruption to services.

17 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

12. Roles and Responsibilities

12.1 Government Roles

• Contracting Officer (CO):

o Holds overall contractual authority o Issues contract modifications, resolves disputes, and makes all binding decisions on behalf of the Government

• Contracting Officer’s Representative (COR):

o Provides technical direction and oversight o Reviews and approves deliverables o Monitors performance and compliance with this PWS o Verifies invoices and travel authorizations

• BIE FACE and Early Childhood Program Office:

o Provides program-specific guidance and priorities o Coordinates access to FACE and Early Childhood Program sites and staff o Provides Government-Furnished Information (GFI) as outlined in Section o Supports transition activities between the incumbent and new contractor

12.2 Contractor Roles

• Project Manager (PM):

o Serves as the primary point of contact with the COR and Government stakeholders o Oversees all contractor staff, schedules, and deliverables o Provides regular status updates and participates in meetings as requested

• System Administrator(s):

o Manages cloud platform environments, security controls, access permissions, and system uptime o Implements updates, patches, backups, and monitoring

• Data Analyst(s):

o Conducts mid-year and end-of-year educational analyses, generates dashboards and reports o Maintains data quality checks and validation procedures

• Training and Technical Assistance (TA) Specialist(s):

o Develops and delivers training materials, office hours, and user support o Responds to helpdesk tickets and site requests

• Compliance & Security Specialist(s):

o Ensures FedRAMP, FISMA, NIST, Privacy Act, and Section 508 compliance o Maintains Authority to Operate (ATO) documentation and security reports

13. Additional Administrative Requirements

18 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

13.1 Project Kickoff and Status Meetings

• The Contractor shall participate in a project kickoff meeting (virtual) within 10 business days of award.

• The Contractor shall attend biweekly status meetings (virtual) with the COR and BIE program office to review progress, risks, and upcoming deliverables.

• The Contractor shall provide meeting agendas, notes, and action item logs within three (3) business days after each meeting.

13.2 Reporting Requirements

• The Contractor shall submit monthly written status reports summarizing:

o Work completed during the reporting period o Deliverables submitted and pending o System performance metrics (uptime, helpdesk response times, user satisfaction) o Known issues, risks, and mitigation plans o Staffing changes and training completion status

• Status reports are due no later than the 10th calendar day of each month.

13.3 Communications Protocol

• The Contractor shall maintain regular communication with the COR and respond to inquiries within two (2) business days.

• All official correspondence, questions, and requests for technical direction shall be submitted in writing to the COR.

• The Contractor shall immediately notify the COR of any major incidents, outages, or security events.

13.4 Records Management and Retention

• The Contractor shall maintain all records, communications, and deliverables produced under this contract in accordance with DOI Records Management Policy and Federal Acquisition Regulation (FAR) Subpart 4.7.

• Records must be retained for a minimum of three (3) years after contract closeout, or longer if required by applicable federal law or policy.

• All records shall be provided to the Government within five (5) business days of request.

14. Applicable References and Regulations

The Contractor shall comply with all applicable federal statutes, regulations, policies, and guidance documents, including but not limited to the following:

14.1 Federal Security and Privacy Standards

19 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

• FedRAMP (Federal Risk and Authorization Management Program): Required security authorization framework for federal cloud services.

• FISMA (Federal Information Security Modernization Act): Federal law governing information security for federal agencies.

• NIST SP 800-53: Catalog of security and privacy controls for federal information systems.

• NIST SP 800-37: Risk Management Framework (RMF) for federal information systems.

• FIPS 140-3: Federal standard for validated cryptographic modules.

• Privacy Act of 1974: Governs collection, maintenance, use, and dissemination of personally identifiable information (PII).

• FERPA (Family Educational Rights and Privacy Act): Governs access to and protection of student education records.

• Section 508 of the Rehabilitation Act: Requires accessibility for all information and communication technology (ICT).

14.2 Federal and DOI Acquisition / IT Policy

• Federal Acquisition Regulation (FAR) and Department of the Interior Acquisition Regulation (DIAR)

• DOI Information Technology Security and Privacy Policy

• DOI Records Management Policy

• Federal Travel Regulation (FTR) (for all contractor travel)

• OMB Circular A-130: Managing Information as a Strategic Resource

14.3 Program-Specific References

• BIE FACE Program Guidance

• BIE Early Childhood Program Guidance

• Any additional BIE technical specifications, branding standards, or SOPs provided by the COR

15. Acronyms and Definitions

Acronym Definition AQL Acceptable Quality Level — minimum performance threshold under the QASP

ATO /

ATU

Authority to Operate / Authority to Use — formal authorization to run a federal system

BOS Bureau-Operated School — a school directly managed by the Bureau of Indian Education

BIE Bureau of Indian Education — federal agency within the U.S. Department of the Interior

CUI Controlled Unclassified Information — federally designated sensitive information COR Contracting Officer’s Representative — Government technical oversight official

20 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

Acronym Definition CO Contracting Officer — Government official with binding contractual authority DOI Department of the Interior

FACE

Family and Child Education — a comprehensive BIE program that delivers integrated early childhood and family literacy services through three coordinated components: Prekindergarten (center-based early learning for children ages 3–5), Family Engagement (home-based services for children birth to age 5), and Adult Education (literacy and workforce readiness for parents and caregivers)

FISMA Federal Information Security Modernization Act FedRAMP Federal Risk and Authorization Management Program FERPA Family Educational Rights and Privacy Act FIPS Federal Information Processing Standards FTR Federal Travel Regulation GFE / GFI Government-Furnished Equipment / Government-Furnished Information MFA Multifactor Authentication NACI National Agency Check with Inquiries (Tier 1 background investigation) NIST National Institute of Standards and Technology PII Personally Identifiable Information PoP Period of Performance PWS Performance Work Statement QASP Quality Assurance Surveillance Plan RBAC Role-Based Access Control SaaS Software as a Service SOP Standard Operating Procedure SSP System Security Plan TA Technical Assistance

TCS Tribally Controlled School — a school operated by a federally recognized Tribe under a 638 or 297 funding agreement

508 Section 508 of the Rehabilitation Act (ICT accessibility requirements)

21 | P a g e

Family and Child Education (FACE) and Early Childhood Programs

Key Term Definitions

• Family and Child Education (FACE): A comprehensive BIE program designed to support children’s school readiness and family engagement through three coordinated components: Prekindergarten (center-based early childhood services for children ages 3–5), Family Engagement (home-based early learning and parenting support for children birth–5), and Adult Education (literacy, high school equivalency, and workforce readiness programs for parents and caregivers).

• Early Childhood Program (ECP): BIE program responsible for coordinating and reporting on Part B Section 619 and Part C IDEA services for infants and toddlers across Tribes and schools. Collects annual Child Count data and ensures compliance with federal early intervention requirements.

• FACE Program: The national Bureau of Indian Education (BIE) program that oversees and funds Family and Child Education services across all participating schools. The FACE Program manages program guidance, contracts, data systems, training, technical assistance, and oversight for all FACE sites.

• FACE Site: An individual school location that implements the FACE Program locally, operating one or more of the three program components (Prekindergarten, Family Engagement, and Adult Education) and reporting data to BIE under program requirements

• Prekindergarten (FACE Component): Center-based early learning services for children ages 3–5 provided on-site at FACE schools.

• Family Engagement (FACE Component): Home-based early learning and parenting support services for children from birth to age 5 and their families.

• Adult Education (FACE Component): Literacy, high school equivalency, and workforce readiness services provided to FACE parents and caregivers.

• Child Count: The federally required annual count of infants and toddlers with disabilities receiving early intervention or special education services under IDEA.

• Data Schema: The complete structure of the database, including tables, fields, relationships, and metadata.

• Data Dictionary: A document describing the meaning, format, and allowable values for each data element in the system.

• Human-Centered Design: An approach to system design that prioritizes usability, accessibility, and the real-world needs of end users.

• Modular Design: An architecture built from independent components (modules) that can be updated or replaced without disrupting other parts of the system.

• Ad Hoc Reporting: A flexible reporting feature that allows authorized users to create custom reports without developer support.