United States Community College

Consortium for Integrate Academic Solutions (CIAS)

Attachment I: Secure Data Sharing Technical Requirements

Version 0.2

20 October 2024

Distribution Statement D: Distribution authorized to the Department of Defense (DoD) and U.S. DoD contractors only, Administrative Use, August 2024. Other requests for this document shall be referred to the USNCC Program Manager.

Destruction Notice: Non-record For Official Use Only (FOUO) documents may be destroyed by shredding or tearing into pieces and discarding the pieces in a regular trash container.

Revision History

Ver No Date Authority Description

0.1 8/15/2024 Lava Salih Initial Draft

0.2 10/21/2024 Theresa Pettersson Lava Salih

2nd Draft

Contents

1.0 Purpose

2.0 Scope

3.0 Definitions and Acronyms

4.0 USNCC Capabilities

5.0 Partner Institution Tiers

6.0 API Transition Plan

7.0 Roles and Responsibilities

7.1 USNCC Data Team

7.2 Partner Institution (PI)

7.3 Joint Responsibilities (USNCC and PI)

8.0 Data Sharing Guidelines

8.1 Current Data Sharing Protocol (SFTP)

8.2 Data Sharing Requirements

8.3 Data Sharing and Confidentiality

8.4 Compliance

8.5 IDIQ Contract Termination and Data Requirements

8.6 Data Dictionary and File Feeds

9.0 Data Sharing Integration Phases

9.1 Phases 0-5 Schedule: Activities/Deliverables and Tracking (~6-9 months)

9.1.1 Onboarding (2 weeks - 1 Month)

9.1.2 Implementation (18 Weeks – 6 months)

9.1.3 GO/NOGO

9.2 Post Phase 5 (Transition and Ongoing Execution) Schedule

9.2.1 Execution (Transition and Ongoing) Refinement and Issue Resolution

9.2.2 Execution Schedule

9.2.3 Issue Reporting and Resolution

9.2.4 Adjustments and Revisions

10. Acknowledgement

11. USNCC Points of Contact (POC)

1.0 Purpose

This document outlines the technical requirements for secure data sharing between the United States Naval Community College (USNCC) and Contractor(s) awarded the USNCC Academic Programs and Services Indefinite Delivery Indefinite Quantity contract (hereafter Partner Institution/PI). Initially, both Tier 1 and Tier 2 institutions will use Secure File Transfer Protocol (SFTP) based on their respective capabilities. Tier 1 and Tier 2 institutions will transition to Application Programming Interface (API) based data sharing once USNCC has implemented API functionality and based upon the timelines outlined in this document. The goal of this document is to support USNCC’s operational objectives for secure and efficient data exchange to support maritime forces personnel in USNCC academic programs.

2.0 Scope

The scope of the technical requirements covers the secure processes, responsibilities, and obligations related to the sharing of student academic data between USNCC and Partner Institution including:

guidelines for handling and transmitting student and academic data, compliance with legal and regulatory requirements, including the Federal Information Security

Management Act (FISMA) and Defense Federal Acquisition Regulation Supplement (DFARS), scheduling for the data sharing lifecycle, and adjustments, updates and revisions necessary to maintain data consistency.

3.0 Definitions and Acronyms

API (Application Programming Interface) – a software intermediary that facilitates the transfer of information between different apps.

CSV (Comma-separated Values) – a text file that has a specific format which allows data to be saved in a table structured format

Data Sharing – two-way electronic sharing of individual or aggregated Personally Identifiable Information (PII) between USNCC and the Partner Institution.

Outgoing – data flowing out of the USNCC to the Partner Institution Incoming – data flowing into the USNCC from the Partner Institution.

Data Technical Requirements – documents USNCCs high-level terms and conditions under which data sharing between USNCC and the Partner Institutions will occur.

DFARS (Defense Federal Acquisition Regulation Supplement) 252.204-7012 – A regulation requiring DoD contractors to safeguard covered defense information and report cyber incidents.

FISMA (Federal Information Security Management Act) – A U.S. law that provides a comprehensive framework for securing federal information systems.

Indefinite Delivery, Indefinite Quantity (IDIQ) – provides for an indefinite quantity, within stated limits, of supplies or services during a fixed period. This Technical Requirements document falls under the authority of the USNCC Academic Programs and Services IDIQ contract.

PII (Personally Identifiable Information) – information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. (OMB Memorandum M-07-1616).

RSA (Rivest-Shamir-Adleman) – a widely used public-key crypto-system that enables secure data transmission, digital signatures, and key exchange

SFTP (Secure File Transfer Protocol) – uses secure shell encryption to provide a high level of security for sending and receiving file transfers. To use SFTP, SFTP client software is required to connect to an SFTP server, where files can be uploaded, stored, and retrieved in a downloadable format.

Secure File Transfer Protocol (SFTP) Server – the type of storage location where files are stored and retrieved.

SLA (Service Level Agreement) – the set of standards agreed upon which define the level of performance, including Data Quality standards at minimum Accuracy, Completeness and Timeliness.

4.0 USNCC Capabilities

SFTP Data Exchange: Currently, USNCC employs Secure File Transfer Protocol (SFTP) for secure data exchange. All data is manually transferred on a weekly basis, with file formats defined in the USNCC data dictionary.

Transition to API: USNCC anticipates implementing automated data exchange through Application Programming Interface (API) calls during the course of this contract. Once this capability is in place, USNCC will work with Tier 1 Institutions to immediately transition from SFTP transfers to API-based automation. USNCC will work with Tier 2 PIs to implement API calls according to institutional capabilities with all PIs required to use automated systems within one year of initial USNCC API deployment.

5.0 Partner Institution Tiers

USNCC will classify PIs into two tiers based on the PIs data-sharing capabilities at the time of award:

1) Tier 1: Initially, Tier 1 PIs shall use SFTP for file transfer and will have internal capabilities to automate (schedule/script) the import and export of data. After USNCC implements API functionality, Tier 1 institutions shall transition to API for fully automated, real-time data transfers, eliminating the need for manual intervention.

2) Tier 2: Initially, Tier 2 PIs shall use SFTP for manual file transfers on a weekly basis. Weekly files may need manual work to create, review and place within the SFTP system. These institutions may not have the infrastructure to transition to API immediately, but they shall gradually shift to automated transfers as their capabilities improve according to the timeline above.

6.0 API Transition Plan

Once USNCC has API functionality in place:

6.1 Tier 1

PIs shall transition to API-based data exchanges.

6.2 Tier 2

PIs shall continue using SFTP but shall move toward API depending on their technological development.

6.2.1 Tier 2 PIs shall have the resources to successfully execute the requirements in this document in a manual manner without intervention or mitigation from USNCC.

6.2.2 Should the PI remain designated as a Tier 2 institution, USNCC may limit enrollments (and associated credits). This limitation will remain in effect until:

1) the PI transitions to Tier 1 status, or

2) demonstrates, through manual processes or other means, the capacity to meet USNCC required timeframes and performance expectations without placing an undue burden on the USNCC.

7.0 Roles and Responsibilities

7.1 USNCC Data Team

The USNCC Data Team is responsible for the overall coordination and governance of the data sharing process with PIs. Specific responsibilities include:

1) Establish Guidelines: establish and enforce data-sharing guidelines that PIs must adhere to, ensuring compliance with USNCC’s technical and security requirements.

2) Data Format and Submission: specify the types of data to be shared, the required formats (CSV), and the timelines for submission. This includes determining whether the PI will use SFTP or, in the future, API for data transfers.

3) Data Accuracy and Integrity: validate incoming data to ensure it adheres to USNCC standards for accuracy, consistency, and integrity. Data will be checked against the established data dictionary to ensure uniform interpretation across all academic programs and services

4) Communication and Issue Resolution: communicate to. the PI any issues related to data, such as formatting errors, validation failures, or discrepancies via Confluence. The Data Team will also set deadlines for the PI to address any corrections.

5) Security Protocols: validate that data-sharing methods (SFTP, or API) meet the necessary security protocols, such as encryption and authentication, and comply with FISMA, DFARS, and other relevant regulations.

6) API Transition Planning: oversee the transition to API-based data exchanges once USNCC has implemented this capability.

7.2 Partner Institution (PI)

The Partner Institution is responsible for ensuring that data sharing is conducted securely and accurately according to the agreed-upon guidelines. Specific responsibilities include that the PI shall:

1) Coordination and Personnel: coordinate all necessary personnel to execute the data-sharing technical requirements. This includes appointing an IT champion who will oversee the implementation and execution of these requirements.

2) Data Extraction and Sharing: extract the required data from their systems and securely transfer it to USNCC via the agreed-upon method. Data must be formatted according to the USNCC data dictionary.

a) For SFTP: use SFTP to securely place extracted data on the SFTP server in the specified format (CSV) and within the timelines established by USNCC.

b) For API: shall securely exchange data according to API protocols according to the USNCC established timeline and in the specified format

3) Data Accuracy and Corrections: maintain accuracy of all submitted data. In the event of discrepancies or errors, the PI shall correct and resend the data either in the next scheduled feed or via an ad-hoc feed with SLAs described below.

4) Issue Response: respond promptly to any issues raised by USNCC related to data integrity, security breaches, or other discrepancies. Ad-hoc adjustments or additional data feeds may be required to address recurring or critical issues.

a) Tier 1 and Tier 2 issue response SLA: 3 business days

5) Security and Compliance: shall comply with the security protocols outlined by USNCC, including encryption requirements for PII. Additionally, the PI shall adhere to FISMA, DFARS, and other legal obligations concerning data protection.

6) API Transition Planning: work with USNCC to transition to API-based data sharing when USNCC is API enabled. The PI will ensure they meet the required technical specifications for API usage, including secure authentication and encryption standards.

7.3 Joint Responsibilities (USNCC and PI)

USNCC will collaborate with the PI to establish and maintain secure data sharing, adhering to the guidelines and timelines provided. Joint responsibilities include:

1) Data Dictionary Maintenance: Both parties will work together to ensure the data dictionary is updated regularly, reflecting any changes in academic programs or data-sharing needs. Bi-annual reviews will be conducted to make necessary revisions.

2) Error Resolution and Continuous Improvement: USNCC and the PI will collaborate to resolve any recurring data issues and work on improving the quality and efficiency of data-sharing processes. Communication includes

a) Meetings as needed (weekly, bi-weekly, or monthly and ad hoc) depending on the PIs Tier, phase of integration, and number and complexity of issues, and ongoing documentation. 7.0 Data Sharing Guidelines

b) To facilitate secure file transfers, USNCC currently uses SFTP with SSH encryption.

USNCC will also use DOD SAFE for ADHOC file transfers if necessary due to PI technology constraints.

8.0 Data Sharing Guidelines

8.1 Current Data Sharing Protocol (SFTP)

All PIs, regardless of tier, will initially use SFTP for data transfers. This method provides secure data transfer protocols, with encryption to protect data at rest and in transit. DoD SAFE is available for ADHOC file transfer outside the scope of the formal Data Sharing process. The PI shall not use DoD SAFE as a regular means for data exchange due to the highly manual and time-consuming process.

8.2 Data Sharing Requirements

1) SFTP Setup: The PI shall generate an RSA key pair and establish a secure SFTP connection through which files will be transferred

a) PI shall download PuTTY to generate an RSA key pair.

b) The PI shall mail the RSA public key to Data_Science_Team@USNCC.edu to create the connection account.

2) Data Format: Data shared through either SFTP must follow the latest version of the USNCC data dictionary, using CSV format, and using timelines specified by USNCC.

3) Detailed Instructions and Issues: for further instructions or is the PI has issues, contact the Data

Team at Data_Science_Team@USNCC.edu

8.3 Data Sharing and Confidentiality

1) The Partner Institution shall have documented information security policies and procedures to reduce information technology security risks to an acceptable level in accordance with the Federal Information Security Management Act (FISMA).

2) The institution shall secure data in transit and at rest by using encryption to protect Personally Identifiable Information (PII) or any other type of sensitive data.

3) The Partner Institution shall maintain confidentiality of shared data

a) The Partner Institution shall restrict data access to authorized personnel.

8.4 Compliance

1) The Partner Institution shall comply with all applicable laws, regulations, and policies governing Government data Sharing and retention.

2) When responding to USNCC updates to the data dictionary, the PI shall maintain the compliance and data accuracy standards outlined herein.

8.5 IDIQ Contract Termination and Data Requirements

Termination of the Indefinite Delivery, Indefinite Quantity (IDIQ) contract does not absolve the Partner Institution from responsibilities regarding previously shared data. The PI must continue to safeguard and comply with all data-sharing agreements outlined in these Technical Requirements, even after the termination of the contract.

8.6 Data Dictionary and File Feeds

The attached documents include the current iteration of the USNCC Data Dictionary along with URLs to both Inbound and Outbound Data Feeds. It details the Frequency and Timing of transmissions to ensure consistent and timely data Sharing and specifies the required field data types for each feed. The inbound and outbound tabs provide URLs that link to the detailed definitions of the respective data feeds, ensuring easy access and clarity in data transmission. (ATTACHED TO THIS DOCUMENT)

9.0 Data Sharing Integration Phases

The data-sharing integration process is divided into six phases (phase zero-six), each with specific activities and milestones that map to USNCCs overall stages of programmatic development as follows:

USNCC PROGRAM STAGE Tech Phase (s) New Partner/New Program

Onboarding 0 6-9 month

Implementation 1-5

LAUNCH (Start of Classes)

Execution - transition 3 months

Execution Ongoing

During these phases, USNCC and the Partner Institution will collaborate to establish relationships and rules of engagement (onboarding) followed by developing all technical and data related aspects of the program prior to students enrolling in the first course (implementation).

These phases involve detailed planning and implementation including establishing and maintaining business relations, assigning roles and responsibilities of individual team members; the technical setup of data-sharing mechanisms; activity scheduling; establishment of timelines and coordination of functional and technical requirements and further refinement, updates, and issue resolution; as well as maintaining detailed documentation.

9.1 Phases 0-5 Schedule: Activities/Deliverables and Tracking (~6-9 months)

1) USNCC will provide a comprehensive schedule of all activities and deliverables necessary to successfully complete each phase and move to the next phase of technical development. The schedule will outline when tasks are due and the level of quality expected, as well as serve as documentation of progress on each assigned deliverable. This schedule will serve as the foundation for the collaboration between USNCC and the PI, so both parties remain aligned, and progress is tracked systematically.

2) The main goal of the Activities/Deliverables and Tracking Schedule is to facilitate clear communication and promote accountability between USNCC and the Partner Institution. Both parties will have access to this document, fostering shared accountability, transparency and collaboration.

3) Regular updates will be shared, and any issues that arise during implementation will be documented and addressed promptly. This will help both USNCC and the Partner Institution resolve challenges quickly and continue making progress.

4) The Schedule outlines and tracks activities and deliverables. It:

a) Lists weekly activities that need to be completed by each team.

b) Designates an owner responsible for each task, ensuring clear accountability. The owner must be named.

c) Identifies the specific phases during which these tasks will be performed. For example, some tasks may fall under phase 0 (e.g., acknowledgement of this document), while others may occur during phase 3 (e.g., refining data exchange processes based on test results).

d) Includes USNCC/PI sign-off points where:

i) USNCC team leads or managers will verify that tasks are completed successfully and meet all technical and programmatic requirements.

ii) The PI will sign-off agreement and may document responses, or other forms of feedback

e) Provides a space for documenting any issues encountered during the process, as well as tracking resolutions and follow-up actions.

9.1.1 Onboarding (2 weeks - 1 Month)

This phase establishes the framework for collaboration and defines roles and responsibilities for secure data sharing.

Key Activities:

Stakeholder Introductions: USNCC and the PI will introduce key personnel, including IT leads and data managers. The executive-level IT champion, appointed to oversee the integration at the institutional level, shall attend no less than the first two technical meetings.

Define Roles: USNCC and the PI will review and outline respective responsibilities for driving deliverables, managing data, handling technical issues, and making key decisions. This will include specific naming of individuals assigned responsibilities for key areas of data sharing and integration.

Assess PI Capabilities: USNCC will review the PIs self-assessment of capabilities and report any discrepancies to the Consortium Team.

Establish Security Protocols: Teams will Review security policies to ensure compliance with FISMA, DFARS, and encryption standards for SFTP.

Sample Deliverables:

Secure connection setup for SFTP, including RSA key exchange.

Documentation of roles, responsibilities, and initial transfer schedules.

Kickoff meeting to finalize expectations and timelines.

9.1.2 Implementation (18 Weeks – 6 months)

In this phase, the data-sharing processes and protocols are technically implemented and tested.

Key Activities:

Data Dictionary Alignment: Both USNCC and the PI will align on a shared data dictionary to standardize data definitions and formats.

SFTP Setup: For both Tier 1 and Tier 2 institutions, SFTP processes are established, and file transfers are tested.

Use Case Testing: Both tiers will engage in scenario-based data-sharing tests, such as student record updates, enrollment changes, and course completions. Data will be validated for accuracy, security, and compliance with USNCC's standards.

Data Validation: Test data will be validated to ensure it meets the agreed-upon data dictionary standards and is properly secured during transmission.

Sample Deliverables:

SFTP test reports, including data transmission logs.

Documented validation of data accuracy and formatting compliance.

9.1.3 GO/NOGO

1) At a specified point in the Implementation Schedule, USNCC will determine if launch (start of the first course in the program) is a GO or a NOGO. Proceeding with the next phase of the project is contingent upon the successful completion of the data exchange up to this point.

a) A ‘go’ decision will be made if the data exchange is seamless, with all required information accurately transferred and integrated, ensuring system compatibility and operational continuity.

b) Any failures in the data exchange, such as data loss, errors, or system integration issues, will result in a ‘no go’ decision, postponing further actions until these issues are resolved.

9.2 Post Phase 5 (Transition and Ongoing Execution) Schedule

USNCC will determine when a PI proceeds to the execution stage.

9.2.1 Execution (Transition and Ongoing) Refinement and Issue Resolution

This phase involves the transition to and status of long-term execution and refinement of data sharing.

Key Activities:

Ongoing Data Exchanges: Both Tier 1 and Tier 2 institutions will continue their regular data exchanges via SFTP.

Data Dictionary Updates: Regular bi-annual updates to the data dictionary will be implemented to keep the data definitions in sync with system and program changes.

Error Reporting and Resolution: USNCC will monitor ongoing data transfers, identify any data issues, and ensure prompt correction by PIs within three business days.

Sample Deliverables:

Bi-annual data dictionary revision documents.

Logs of weekly data exchanges (SFTP).

Issue tracking reports, resolution timelines, and sign-off.

9.2.2 Execution Schedule

The frequency of the data exchange will be determined by the specific data requirements, ensuring that the exchange occurs at intervals necessary to meet the demand for up-to-date and relevant information.

The cadence of these exchanges will be aligned with the volume and timing of the data needed for accurate reporting and system functionality.

9.2.3 Issue Reporting and Resolution

The USNCC Data Team will work closely with the PI, providing clear and actionable feedback on any issues encountered. Efforts will be made to resolve recurring problems and continuously improve the overall quality and efficiency of the data Sharing process through regularly scheduled meetings (weekly, biweekly, or monthly as outlined above) and by using Confluence for ongoing communication and documentation.

PI Response SLA Tier 1 and Tier2: The Institutions shall:

1) respond to issues within 3 business days of receipt of USNCC issue report

2) provide ad hoc or additional data feeds as necessary to correct any identified data discrepancies.

Error Response Protocol The two most common cases of USNCC requiring data adjustments, and an outline of the PI requirements are as follows:

3) Data Validation: upon receiving data feeds from the PI, conducting necessary validations to ensure data quality, consistency, and compliance with the predefined data dictionary.

4) Random error detection: USNCC discovers an error through everyday use of data, e.g. a record for a student who never applied, two different birthdays for the same student, etc.

5) USNCC will communicate any issues or discrepancies to the Partner Institution, detailing the following the nature of the issue and course of action:

▫ identified data issue(s), ▫ the nature of the problem(s) ▫ required corrections ▫ the expected timeline for issue resolution o The PI shall respond to all requests for adjustments within the SLAs described in Section 6.1. PI Responsibilities. Additionally, the institution shall provide ad-hoc or additional data feeds as necessary to rectify identified discrepancies.

9.2.4 Adjustments and Revisions

USNCC expects there to be changes and updates to the Data Dictionary.

1) USNCC–led

a) USNCC anticipates two regularly scheduled Data Dictionary revisions on a yearly basis.

USNCC will work collaboratively with the Partner Institution to ensure continued compliance and data accuracy.

b) The Partner Institution shall comply with USNCC-led changes and scheduled revisions as follows:

c) Adjustments. During the contract period, and to accommodate updates to the USNCC SIS, USNCC may determine it necessary to make ad hoc adjustments to the data dictionary Adjustments will be limited, but inevitable as with any dynamic system.

USNCC will communicate these changes promptly with the expectation that the Partner Institution shall administer these changes within XX amount of time.

d) Bi-annual Data Dictionary Revision. During the contract period, USNCC will revise the data dictionary no more than two times per year. The Partner Institution shall have the resources committed to complete these projects in the timeframe outlined by USNCC.

USNCC reserves the right to 1) change the timing of data dictionary revisions and 2) schedule more or less revisions. USNCC will notify the Partner Institution in writing 2 months prior should there be any changes to the revision schedule.

2) PI–led

a) The PI shall notify USNCC of any changes to the PI field changes that may impact data mapping to USNCC in writing no less than two months prior to said change.

10. Acknowledgement

The Partner Institution shall formally acknowledge this Data Sharing Technical Requirements immediately following award and prior to commencement of the implementation schedule.

11. USNCC Points of Contact (POC)

This table summarizes the USNCC list of contacts responsible for Data Sharing implementation.

POC Email Title

Theresa Pettersson Theresa.Pettersson@USNCC.edu Director of Academic Consortia

Spencer Winn Spencer.Winn@USNCC.edu Contracting Specialist

Lava Salih Lava.Salih@USNCC.edu Command Data Officer

Richard Stoner Richard.Stoner@USNCC.edu Director of Educational Technology