Attachment_2_-_Performance_Requirement_Summary.pdf

NATIVE AMERICAN STUDENT INFORMATION SYSTEM (NASIS) Version 2.0

PERFORMANCE REQUIREMENT SUMMARY (PRS)

PWS

Sec.

TYPE PERFORMANCE STANDARD ACCEPTABLE

QUALITY LEVEL

(AQL)1

METHOD OF

INSPECTION

2. GENERAL REQUIREMENTS

2.2.1 Services Delivery

Method The contractor shall provide a Software-as-a-Service (SaaS) cloud-based system managed.

TBD TBD

2.2.2 Contingency

Planning and Disaster Recovery

Contingency Planning Guide for Information Technology Systems that is updated on an annual basis and that the plan be tested and documented on an annual basis.

No less than 90% Annually

2.2.3 System Security

Plan

Contractor shall provide a delivery service by a Cloud Service Provider. No less than 99.7% TBD

2.2.4 Annual System

Security Review

Contractor shall undergo annual security reviews No less than 99.9% Annually

2.2.5 Assessment and

Authorization

Contractor shall provide timely access ALL information that is related to the NASIS system and any NASIS contractor operated hosting facility to perform the A&A.

No less than 99.9% At the request of the Government

2.2.6 Infrastructure Contractor shall provide the infrastructure necessary to operate and maintain NASIS. NASIS is required to be available on a 24x7 basis with 99.97% uptime.

No less than 99.7% Daily

2.2.7 Section 508

Compliance

Contractor shall ensure that all electronic and information technology delivered in compliance with this PWS meets the accessibility standards of 365 Code of Federal Regulations (CFR) 1194.36. CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended March 23, 2018.

No less than 100% No later than 3wks after award.

Annually

2.2.8 Background

Investigations

Contractor employees who will have access to DOI information and/or will develop custom applications are subject to background investigations.

No less than 100% Within 2 months of award

2.2.9 Non-disclosure

Agreements (NDA)

Contractor employees who will have access to DOI or Service information or will develop custom applications must sign a non-disclosure agreement prior to gaining access.

No less than 100% 3wks after award

1 AQL – Contractor shall meet or exceed the identified % of the action to be considered satisfactory.

NATIVE AMERICAN STUDENT INFORMATION SYSTEM (NASIS)

2.2.10 Security Awareness

Training (SAT)

Contractor employees must take DOI’s end-user computer security awareness training prior to being granted access to DOI data or being issued a user account.

No less than 100% Annually

2.2.11 Personnel Changes The contractor must notify the COR immediately when an employee working on the NASIS system has been reassigned or leaves the contractor’s employment or a new employee has been added to replace a missing employee.

No less than 90% Annually

2.2.12 Contractor

Location

Work is to be completed virtually and/or in the contractor facility under direction of the CO and the contractor Lead Point of Contact

(POC).

No less than 99.9% Periodic, monthly, quarterly

2.2.13 Intellectual

Property Rights

DOI will own the intellectual property rights to any software developed on its behalf to the maximum extent practical.

No less than 100% Annually

2.2.14 Independent

Validation and Verification

The BIE will perform the initial validation and verification during acceptance testing and reserves the right to bring in an independent group to perform an IV&V in future years of the contract.

No less than 99.9% At the request of the Government

2.2.15 System Logon

Banner

Applications developed or maintained under this contract must contain a BIE approved logon warning advising users of rules, restrictions, and privacy expectations for that application.

No less than 99.9% Daily

2.2.16 Incident Reporting The contractor must report computer security incidents affecting DOI/BIE data or systems in accordance with the DOI Computer Incident Response Guide ASAP, daily during the investigation of said incident and finally weekly during the resolve of said incident.

No less than 100% • ASAP

• Daily

• Weekly

2.2.17 Quality Control

Malware Code

All software and hardware must be free of malicious code. No less than 100% At the request of the Government

2.2.18 Annual Self-

Assessment

The contractor must conduct an annual self-assessment in accordance with NIST SP 800-53 Rev. 5 and NIST SP 800-53A Rev. 5 on all MAs, GSSs, and outsourced applications in production or a reference to public facilities, such as a website or office, where it may be accessed.

No less than 99.9% As requested, Annually

2.2.19 System Logon

Banner Acknowledgement

All access DOI data must acknowledge a Government-approved logon warning prior to each new logon to the system.

No less than 99.9% At the request of the Government

2.2.20 Security Controls Contractors will be required to ensure compliance with the security control requirements of NIST SP 800-53 Rev. 5, or current version, and

No less than 99.9% At the request of the Government

Federal Information Processing Standard (FIPS) 200, which are appropriate to the sensitivity and criticality of the data or system.

2.2.21 Contingency Plan

Test

The contractor will submit a contingency plan in accordance with NIST SP 800-34 Rev. 1 (as amended) or current version and the DOI Contingency Plan Guide.

No less than 99.9% Annually

2.2.22 Vulnerability

Analysis

All systems operated and managed by the incumbent contractor shall be scanned at a minimum monthly with a vulnerability analysis tool to be consistent with Government requirements.

No less than 99.9% Monthly 15days for patch – C 30days for patch – H

2.2.23 Privacy Impact

Assessment (PIA)

The contractor shall create a PIA within 2wks of award No less than 99.9% As requested, Annually

2.2.24 System Of Records

Notice

The NASIS system must have the current SORN updated to the new requirements in the RDD.

No less than 99.9% Annually

2.2.252 List of IT Security

Related Deliverables

See PWS, p. 18-19 for details for the deliverables No less than 99.9% See PWS

2.3 Program Technical

Support

The Contractor shall provide program technical support as requested by the BIE team

No less than 99.9% As requested

2.4 BIE CSP

Operational Control

The current Contractor shall support the BIE transition and migration to the incumbent NASIS contractor Operational Control as required

No less than 100% 180 days after Contract Award

3. SPECIFIC TASKS

3.1.1 Implementation

and Test Plan

(I&TP)

A draft I&TP with Milestones will be provided to the BIE not later than 10 calendar days following the execution of the contract.

No less than 95% 10 calendar days after Contract Award, Monthly

3.1.2 Monthly Status

Report

Due by the 10th of each month for the preceding month, shall describe accomplishments for the reporting period, issues, current and cumulative financial status, and projected activities for the next reporting period.

No less than 90% As requested, Monthly

3.1.3 Weekly Status

Reports

To be provided by the close of business on the last working day of each week. Each report shall describe accomplishments for the reporting period, issues, current and cumulative financial status, and projected activities for the next reporting period.

No less than 90% As requested, Weekly

2 2.2.25 List of IT Security Related Deliverable, PRS and RDD are in addition to each other.

3.1.4 Weekly Progress

Meetings

Weekly progress meetings shall be used to raise issues, present status, and progress, and make decisions.

No less than 90% As requested, Weekly

3.1.5 Action Item

Tracking

Action Items List at the Contractor level and review the status of the items at the Weekly Progress Meetings

No less than 90% As requested, Ongoing

3.1.6 Quarterly Progress

Reporting (QPR)

To provide a comprehensive review of the status of the contract to include execution against the schedule and expenditures plan, progress toward addressing action Items, potential issues, recommendations for project enhancements, and plans for the next quarter.

No less than 90% As requested, Quarterly

3.1.7 Web-based Project

Information Exchange

Contractor recommendation shall be delivered to the Government within three (3) weeks after execution of this contract and have an operational website not later than three (3) weeks from the Governments approval to proceed.

No less than 90% 3-wks after Contract Award, Ongoing

3.1.8 Project Kick-Off An integrated team project kick-off meeting to be held not later than ten (10) business days following execution of the contract.

No less than 90% 10-days after Contract Award

3.2.1 ESSA Reporting The Contractor will produce, maintain, and update the summative data that will facilitate inputting data by the BIE into the CSPR portion of the Education Data Exchange Network (EDEN). In general, data included can be found within the NASIS system and includes summative data and disaggregated data.

No less than 100% Periodic, monthly

3.2.2 ISEP Reporting The ISEP process involves the direct participation of schools, Education Resource Centers (ERC), and BIE Offices. Schools must encode the required student data and ensure the appropriate documentation is on file to justify funding.

No less than 100% Periodic, monthly, annually

3.2.3 US Department of

Education Reporting

Reporting is by submittal of EDFacts files No less than 100% Periodic, monthly

3.2.4 Federal Reporting The contractor must be able to produce reports from the data in the system that will allow the BIE to report performance and improvement as required by the Government Performance and Results Act (GPRA) Modernization Act of 2010.

No less than 90% Annually

3.2.5 Management

Reporting

The contractor shall provide a detailed Application Utilization Report that can be initiated on-demand from the state level NASIS software. The report will allow the user to specify start and end

No less than 90% As requested, monthly dates for the utilization period. The report will be ordered alphabetically by Education Resource Centers and alphabetically by School Name within each ERC and ADD.

3.2.6 EDFacts Reporting

Module

The Contractor will develop an EDFacts module with an end product in the appropriate submittable format.

No less than 99.9% Within six (6) months of Contract Award.

3.3.1 Special Education

IEP forms and BIE State Reports

The system shall configure the IEP forms and state reports within the application to meet BIE and federal reporting requirements as specified within the RDD.

No less than 99.9% As requested, annually

3.3.2 Special Education

Process Forms and BIE State Reports

The system shall configure all other Special Education support forms and state reports within the application to meet BIE and federal reporting requirements as specified within the RDD. This is to include generating and printing of service logs.

3.3.3 FACE Program

BIE State Reports

The system shall provide reporting needs for Family and Child Education Programs (FACE Program).

3.3.4 Gifted and Talented

BIE State Reports

The system shall configure all Gifted and Talented forms and state reports within the application to meet BIE and regulatory reporting requirements as specified within the RDD.A report of active and non-active students shall be developed.

3.3.5 English Learners

Forms and BIE State Reports

The system shall configure all English Learners forms and state reports within the application to meet BIE requirements, regulatory, and statutory as specified within the RDD. A report of active and non-active students shall be developed.

3.3.6 Native Language

Learners and BIE State Reports

The system shall configure all Native Language Learners forms and state reports within the application to meet BIE requirements, regulatory, and statutory as specified within the RDD.

3.4.1 Interchange

Training

Contractor shall provide an interchange training, which is a multi-day session where training will be conducted and will focus on areas that have been determined based on NASIS user requests or analysis of user patterns. 70% shall be considered passing for participates.

No less than 90% Quarterly

3.4.2 Virtual User

Training

Contractor shall provide virtual user training that will illustrate training participant's proficiency and generate a certificate of completion. 70% shall be considered passing for participates.

No less than 90% Quarterly

3.4.3 NASIS User Training A schedule of trainings will be distributed quarterly electronically to meet requirements as defined by the BIE. Training will be held in a facility or virtually as required by BIE which will allow computer access to the program by participants. 70% shall be considered passing for participates.

No less than 90% Quarterly

3.4.4 Special Education

Forms/Process Training and Other Supplemental Programs

A schedule of trainings will be distributed quarterly electronically to meet requirements as defined by the BIE. Training on the use of the special education module is required. The training shall cover but is not limited to IEP creation and technical processes, all related special education forms to meet BIE and federal reporting requirements. 70% shall be considered passing for participates.

No less than 90% Quarterly

3.4.5 Class Scheduling

Training

A schedule of trainings will be distributed quarterly electronically to meet requirements as defined by the BIE. Training focuses on the process of creating a master schedule which includes courses and sections, room assignments, course requests, and other scheduling related tasks. 70% shall be considered passing for participates.

No less than 90% Quarterly

3.4.6 BIE NASIS

Certification Training

A schedule of trainings will be distributed quarterly electronically to meet requirements as defined by the BIE. Advanced application training leads to a BIE Certified Trainer for the NASIS application.

70% shall be considered passing for participates.

No less than 90% Quarterly

3.5.1 Data

Synchronization

Prioritizing the correction of errors in the consistency of global data from all schools, it will be necessary for the incumbent contractor to monitor the state database and compare all school’s databases. The synchronization between schools and state must occur in near real time.

No less than 99.9% Ongoing

3.5.2 Data

Standardization

Schools that have added or modified the list of allowable values, or that were migrated from other information systems with inconsistent values, including null or blank values, must be converted (using database scripts, custom programs, etc.) to meet the prescribed values in the RDD.

No less than 99.9% Ongoing

3.6.1 License The Contractor shall provide licenses based on student population. No less than 99.9% Ongoing

3.6.2 Application Hosting Requirements found on p. 42. No less than 99.9% Ongoing

3.6.3 Help Desk Support All help desk calls are tracked and reported weekly to BIE in a No less than 99.9% Ongoing format that categorizes the problems, issues, and concerns and subsequent resolutions. The report shall be utilized to determine training needs.

3.73 Deliverables See PWS, p. 44-47 for details for the deliverables No less than 99.9% See PWS

3 3.7 Deliverable, PRS and RDD are in addition to each other.