Attachment J-1 Performance Work Statement 051424.pdf

Performance Work Statement

Controlled Unclassified Information (CUI) 1 11/30/2023

Federal Student Aid

Title IV Origination and Disbursement System & Customer

Service Transition November 30, 2023

Controlled Unclassified Information (CUI) 2 11/30/2023

1.0 GENERAL

1.1 Introduction

1.2 Objective

1.3 Scope of Work

1.4 Background

1.5 Cloud Architecture

1.6 Required Labor Categories

1.7 Key Personnel

1.7.1 EDMAPS Key Personnel

1.7.2 COD, & NSLDS Key Personnel

1.7.3 Customer Service Key Personnel

1.8 Period of Performance

1.9 Place of Performance

1.10 Applicable Documents

1.11 Performance Measures

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 COD Business Requirements

2.2 NSLDS Business Requirements

2.3 EDMAPS & EDWA, FTI Data Mart Requirements

2.4 Customer Service

3.0 CONTRACTOR QUALITY ASSURANCE

4.0 DELIVERY OR DELIVERABLES

5.0 MEETINGS

5.1 Post-award Kickoff Meeting

5.2 Intermittent Project Status Reviews

5.3 Monthly Project Status Reviews

5.4 Program Management Review

6.0 REQUIRED TRAVEL AND OTHER DIRECT COSTS (ODCS)

7.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION

Controlled Unclassified Information (CUI) 3 11/30/2023

Performance Work Statement (PWS) for the TIVOD System and Customer Service Transition Program

1.0 General

1.1 Introduction

Federal Student Aid (FSA), an office of the Department of Education (ED), administers all phases of the Federal student financial aid programs from a student’s submission of the Free Application for Federal Student Aid (FAFSA®) through retirement of student loan debt. In FY 2023, Federal Student Aid delivered more than $114.1 billion to more than 9.7 million students attending approximately 5,600 postsecondary institutions. Federal Student loans have become a core component of postsecondary education financing, serving over 43 million student customers with a loan portfolio more than $1.6 trillion.

In 2017, FSA introduced the Next Generation Financial Services Environment (now referred to as Next Gen), an initiative seeking to transform FSA’s operations and approach to serving more than 70 million students, parents, and borrowers, and partners at approximately 5,600 postsecondary institutions. The Next Gen approach applies not only to student loan servicing, but to all stages of a customer’s journey, including learning about, applying for, receiving, and repaying federal student aid. The goals for Next Gen include:

• Providing a high-quality customer and partner experience throughout the student aid life cycle;

• Improving operational flexibility by creating an environment that can efficiently and effectively integrate new capabilities and features, continuously improve, and innovate, and adjust to stay in compliance with applicable laws and regulations.

• Driving greater operational efficiency, reducing complexity, improving the stability, resiliency, enterprise risk management, and cybersecurity of systems; and ensuring effective and efficient use of taxpayer dollars.

• Improving customer and partner outcomes and overall portfolio performance and facilitating compliance with consumer protection standards.

FSA continues its Next Gen initiative, by procuring a continuation of the services and critical business functions currently provided under the Title IV Origination and Disbursement (TIVOD) contract. This encompasses various systems and capabilities used to meet the requirements of FSA, and industry partners and its customers, such as the Common Origination & Disbursement (COD) system and services, the National Student Loan Data System (NSLDS) and services, , Enterprise Data Management and Analytics Platform Services (EDMAPS), the Enterprise Data Warehouse & Analytics (EDWA), and the Federal Tax Information Datamart (FTI DM) and services, including associated customer support. Collectively, these systems and services are referred to as the “TIVOD System” in this document.

This solicitation will result in the award of a short-term contract serving as a transition vehicle as FSA intends to award new contracts aimed at future modernization and transformation efforts. The primary goal of the transition contract is to ensure continued, timely, and efficient processing of Title IV aid. Additionally, it aims to provide an integrated platform managing and analyzing education-related data efficiently and effectively, supporting decision-making and enhancing outcomes for students and educational institutions.

Controlled Unclassified Information (CUI) 4 11/30/2023

The modernization-focused contract(s) are part of FSA’s long-term strategy to meet evolving business needs, providing enhanced cybersecurity, increased flexibility and efficiency, and a strong foundation for FSA’s long-term operations. These efforts will occur in parallel with the award and implementation of the TIVOD System and Customer Service transition contract; further details about this effort will be released later.

The TIVOD Systems and Customer Service Transition Program is the procurement of a new contract to ensure the continued operations, processes, and critical business functions currently provided by COD, EDMAPS, NSLDS, and the FTI DM. It also aims to provide the associated Customer Service for these processes and operations. When referenced in this document, partners include institutions of higher education, state grant agencies, eligible and approved Guarantee Agencies, Federal Loan Servicers, lenders and lender servicers, FSA staff & Contractors, third-party software providers, third-party services, and ED and its Contractors.

When referenced in this document, customers include anyone who has filed a Free Application for Federal Student Aid (FAFSA).

Contractors may acquire more information via the Student Aid Data Center and FSA’s 2023 Annual Financial Report, linked below:

• https://studentaid.gov/data-center/student

• https://www2.ed.gov/about/reports/annual/2023report/fsa-report.pdf

This document is intended to be used as part of a set of Information Technology (IT) Contract Requirements, which includes the following documents:

• FSA Information Technology Contract Requirements for Information Systems (Development, Modernization, and Enhancement (DME) and Operations and Maintenance (O&M) Contracts)

• FSA Information Technology Contract Requirements for Non-System IT Services

• Department of Education Security and Privacy Requirements for IT Procurements

• Department of Education Contractor Vetting Security Requirements

• FSA Situational IT Contract Requirements

Federal Student Aid seeks to acquire IT-related services involving direct development, implementation, and operations and maintenance support of information systems, databases, and customer service at any time during the solution’s lifecycle.

1.2 Objective

The objectives of the Program are to deliver and manage Title IV program aid in alignment with current laws, regulations, and directives (see section 1.10) by having the contractor:

• perform tasks in an enterprise cloud environment, providing consistent and accessible systems.

• provide a unified partner experience by centralizing operations, enabling self-service, analytics, and compliance; and

• build systems more adept to change, less costly, and more efficient.

Controlled Unclassified Information (CUI) 5 11/30/2023

To accomplish the objectives of the Program the Contractor shall:

• Optimize efficiency and effectiveness while working with schools, other government agencies, software developers, interfacing systems, and other partners to deliver on FSA’s mission.

• Leverage existing cloud infrastructure.

• Enable DevSecOps integrating security as a shared responsibility throughout the entire IT lifecycle.

• Ensure compliance with memorandum M-22-09 setting forth a Federal zero trust architecture (ZTA) strategy.

• Plan and utilize an AGILE software development approach.

• Integrate with FSA’s authentication and access control solutions (Person Authentication System (PAS) and

Access and Identity Management System (AIMS))

• Plan and utilize a Requirements & Document management tool.

• Leverage Commercial Off the Shelf (COTS) products to realize a low- to no-code environment.

• Improve the quality and accessibility of student financial aid data.

• Reduce the administrative burden of Title IV aid.

• Minimize abuse within aid programs by accurately tracking funds awarded to assist postsecondary students.

• Address Federal, Department of Education, and FSA Cybersecurity requirements – EO 14028; requiring agencies to meet specific cybersecurity standards and objectives by the end of Fiscal Year (FY) 2024

1.3 Scope of Work

The scope of the Contractor’s work under this Program includes primarily O&M and incremental improvements of the Common Origination & Disbursement system (COD), the National Student Loan Data System (NSLDS), the Enterprise Data Warehouse & Analytics (EDWA) & Enterprise Data Management and Analytics Platform Services (EDMAPS), the Federal Tax Information Datamart systems (FTI DM), and customer service for FSA partners. O&M also includes the ability to provide and maintain high volume, complex, transaction processing.

The contractor will work to ensure the above-referenced systems and applications meet the applicable IT and business standards referenced in section 1.10 and in the relative system MITCR. They must be ready to adopt to change when FSA is ready to implement enterprise-wide strategies in accordance with the to be determined transition schedule/plan.

The goals of the Program include:

Controlled Unclassified Information (CUI) 6 11/30/2023 o Modernize and secure platforms and business processes to become more flexible and technically agile.

Adopt a software development methodology focused on planning and coordination between business units and rapid adaptation to change o Owning and managing the environments, infrastructure, and documentation within the TIVOD systems necessary for promoting transparency.

o Move to a unified cloud platform providing consolidated services.

o Integrate the approved FSA Enterprise Architecture API management solution and platform automation services within the FSA enterprise.

o Replace inefficient processes with modern, cost – effective, secure systems aligned to support the existing digital front door for Partners.

o Establish architecture governance processes to reduce redundancies o Develop more robust and flexible test environments, available to both partners and FSA.

o Improve data accessibility enabling better insights, management, customer outcomes, and program transparency. Increase data availability, integration, and centralization in the enterprise data warehouse o Develop data governance to establish data accuracy, consistency, repeatability, and security.

o Provide appropriate data accessibility across TIVOD systems for improved self-service and efficiency.

o Increase the strategic use of data for improved insights and management of title IV programs for enhanced customer outcomes o Reduce data latency by moving towards real-time data feeds o Transform operations to create an efficient and intuitive partner experience for both internal and external customers. Empower customers through a comprehensive knowledge center including interactive Q&A, with powerful search capabilities, supporting robust self-service o Build a solution accessing internal workflows to increase automation and efficiency of manual processes o Invest in quality training of CSRs to increase CSR knowledge base, improve customer satisfaction scores, and reduce CSR error rates.

o Increase requirements for the knowledge and experience of CSRs.

o Leverage new and emerging technology (i.e., Artificial Intelligence) to integrate and support customer service capabilities.

o Using data insights to continuously improve the effectiveness and quality of the customer service center, including the customer experience.

This work shall improve transparency and centralize project management tools, code repositories, and common development tools, providing standardization across teams and projects.

1.4 Background

Additional details of the current TIVOD System are shown below and further defined in Section 2 Specific Requirements /Tasks. The purpose of providing this information is to give a clear understanding of the existing system's features, functions, and constraints. This information is intended to help potential offerors understand the context and requirements of the government's needs for the replacement solution.

The functions of the current TIVOD System include:

Controlled Unclassified Information (CUI) 7 11/30/2023

• The COD System processes originations and disbursements for all Title IV programs, managed by Federal Student Aid, and maintains borrower servicer relationships. The COD system also includes operations and service support as well as program management support.

• NSLDS is the first comprehensive national database of information about the federal financial aid history of recipients of student financial assistance, authorized under Title IV of the Higher Education Act of 1965, as amended. Information from NSLDS is used by stakeholders including the White House, Congress, Government Accountability Office (GAO), Office of Inspector General (OIG), lenders, servicers, other federal agencies and most importantly, students and their parents, to provide a comprehensive resource on disbursed Title IV aid.

• EDMAPS is FSA’s unified data platform centralizing, integrating, and managing student aid, customer, school, and partner data. EDMAPS has established several key data systems, databases, and support components.

• EDMAPS hosts two mission-critical data systems:

o EDWA is FSA’s data warehouse, used for analytics, departmental dashboards, reports, views, visualizations, fulfilling data requests, research, analysis, and statistical modeling. EDWA utilizes machine learning models in TIVOD system operations to create better outcomes for our customers and to prevent fraud.

o Person Master Data Management (pMDM) is a database of master customer records interfacing with other FSA systems and software.

• EDMAPS also contains three standalone repositories: Debt Relief, which is intended to be the backend repository of applicants who applied for student loan debt relief; a Private Collection Agency (PCA) repository utilized for analytics and audit reviews; and retired servicer repositories utilized for analytics. In addition to these, EDMAPS has a data lake utilized for capturing incoming data files and an archive zone for inactive data. There’s also a Metadata repository containing data dictionaries, lineage, a business glossary, and field-level rules.

• The FTI DM receives customers’ federal tax information (FTI) from the Internal Revenue Service (IRS) through the Internal Revenue Code § 6103 for the purposes of administering the Free Application for Federal Student Aid (FAFSA®) form, income-driven repayment (IDR) plans, total and permanent disability (TPD discharge), and income verification programs. The FTI DM allows applicants of Federal Student Aid to obtain their tax information automatically and eliminates multi-year certification for IDR plan applicants and TPD applicants—who have William D. Ford Federal Direct Loans (Direct Loans)—which simplifies both online application experiences and prevents many borrowers from defaulting on their federal student loans.

• Partner Customer Support focuses on customer/school satisfaction and control services for NSLDS, COD, EDMAPS, and Partner Connect (a web user interface for our partners). Service control consists of multiple entry points and contacts for service requests, problems, and general user administration. Support services are provided through multiple call numbers and help desks.

Controlled Unclassified Information (CUI) 8 11/30/2023

1.5 Cloud Architecture

The Contractor’s software development approach shall provide the products and services necessary to be FedRAMP authorized, as well as a cloud solution both portable and severable. Proposed solutions shall accommodate migration to the existing enterprise cloud environment. Proposed solutions shall either be positioned as an application tenant in one of two existing platforms in use by FSA, or if the proposed solution is positioned in another platform (not one of the existing FSA platforms) it is expected the solution must be portable to FSA’s enterprise cloud environment in the future.

All application related core functionalities must be derived from the platform. These functions include but are not limited to logging, monitoring, security scanning, Identity and Access Management ( IDAM), Security Information and Event Management (SIEM), version Control, continuous integration and continuous delivery/continuous deployment (CI/CD) pipeline, build management, artifact and configuration management, test automation, telecom, Virtual Private Network (VPN), and firewalls.

Controlled Unclassified Information (CUI) 9 11/30/2023

1.6 Required Labor Categories

The table below lists labor categories required by FSA for this contract. The Contractor may include additional labor categories as deemed necessary.

GSA LABO R

CATEG OR Y

FSA LAB OR

CATEG OR Y EXA MP LE ACTIV IT IE S REQ UI RE D SE C U RITY

BA CKG RO UN D

15-1299.09

IT Project Manager Program Manager

Directs and coordinates the planning and execution of a program involving multiple projects, personnel, and vendors. Plans and manages the operations and execution of several simultaneous technical and non-technical projects. Interacts directly with the senior government officials regarding status, progress, and issues.

Oversees and coordinates the delivery of products and services at the appropriate level of quality, on time and within budget, in accordance with Service Level Agreements (SLAs) and Federal governance standards.

T2, 5C Moderate Risk, Public Trust

15-1299.09

IT Project Manager Project Manager

Lead and guide the work of technical staff. Serve as liaison between business and technical aspects of projects. Plan project stages and assess business implications for each stage.

Monitor progress to assure deadlines, standards, and cost targets are met.

T2, 5C Moderate Risk, Public Trust

15-1243

Database Architect

Database Architect

Ensure effectiveness and efficiencies in our databases through changing requirements, aligned with FSA’s strategic vision. Set standards for database operations, programming, query processes, and security.

Model, design, and construct large relational databases or data warehouses. Create and optimize data models for warehouse infrastructure and workflow. Integrate new systems with existing warehouse structure and refine system performance and functionality.

T4, 6C High Risk, Public Trust

Controlled Unclassified Information (CUI) 10 11/30/2023

FSA LAB OR

CATEG OR Y EXA MP LE ACTIV IT IE S REQ UI RE D SE C U RITY

BA CKG RO UN D

11-1021

Operations Manager

Command Center Manager

Responsible for maintaining and managing systems and operations, formulating policies, responding to technical issues, user issues, audit issues, and operations reporting including capacity planning and licensing. Plans the use of materials and human resources.

T4, 6C High Risk, Public Trust

11-3013

Security Manager Security Manager

Responsible for working with the Information System Security Officer (ISSO) and FSA security staff to assure system compliance to all Federal and Department cyber regulations and controls.

This includes working with auditors to answer questions regarding security posture.

T4, 6C High Risk, Public Trust

15-2051

Data Scientist Data Quality Manager

Responsible for the correct and proper fulfillment of production and ad hoc analytics and reporting requirements. Oversees query writing staff, data science support staff, and contracting staff engaged in supporting FSA statistical model development and implementation.

Ensures data used by an organization is accurate, consistent, and complete.

Define data terminology by creating data dictionaries.

Monitor data quality to ensure consistency.

Reviews data sets, analyzes trends, and addresses any issues promptly.

Create reports detailing data quality issues and resolutions for senior management. Recommend changes to enhance data storage efficiency and accuracy.

T4, 6C High Risk, Public Trust

11-3021

Computer and Information Systems Manager

Development Manager

Uses sound software engineering principles to ensure that developed code is modifiable, efficient, reliable, understandable, and fault tolerant. Codes, and tests software based upon software specifications and designs. Provides software process management and control throughout the coding portion of the software development process.

Controlled Unclassified Information (CUI) 11 11/30/2023

FSA LAB OR

CATEG OR Y EXA MP LE ACTIV IT IE S REQ UI RE D SE C U RITY

BA CKG RO UN D

11-3131

Training & Development Manager

Training Manager

Plan, direct, and coordinate the training and development activities and staff of an organization.

Plan, develop, and provide training and staff development programs, using knowledge of the effectiveness of methods such as classroom training, demonstrations, on-the-job training, meetings, conferences, and workshops.

Develop and organize training manuals, multimedia visual aids, and other educational materials.

Train instructors and supervisors in techniques and skills for training and dealing with employees.

Conduct orientation sessions and arrange on-the-job training for new hires.

T2, 5C Moderate Risk, Public Trust

15-1243

Database Architect Enterprise Architect

Guides full life cycle system implementation planning through assessment or preparation of system management plans and system integration and test plans. Develops system configuration documentation, including detailed designs for capacity planning, security systems and disaster recovery. Analyzes user requirements and high-level system architecture to develop system requirements specifications.

Develops detailed system Architecture and system design documentation. Develops Disaster Recovery Plans. Analyzes the network, telecommunications, and overall system architecture.

Controlled Unclassified Information (CUI) 12 11/30/2023

FSA LAB OR

CATEG OR Y EXA MP LE ACTIV IT IE S REQ UI RE D SE C U RITY

BA CKG RO UN D

15-1253

Software Quality Assurance Analyst & Tester

Test Manager

Responsible for writing test plans in support of all aspects of system design and development lifecycle. Interfaces with the system lifecycle development groups throughout the software development process. Supports the system configuration management process and understands all software components and their interface requirements. Performs system testing at all levels from module or unit testing through all levels of software integration testing.

Develops test data and predefines specific test acceptance criteria.

T2, 5C Moderate Risk, Public Trust

1.7 Key Personnel

FSA requests the Contractor to propose the following labor categories with key personnel, the Contractor may include additional key personnel as deemed necessary.

1.7.1 EDMAPS Key Personnel

The offeror shall propose key personnel for the following:

1. Program Manager – a minimum of 5 years of experience and training and certification in managing large IT programs and related staff, with a special focus on data systems (vs application systems).

2. Data Architect – a minimum of 10 years of experience in architecting databases, data warehouses and marts, data repositories, operational data stores, data lakes, reports, and related technologies and tool.

3. Operations Manager – a minimum of 5 years of experience and certifications in Information Technology

Infrastructure Library (ITIL) based operation and maintenance of AWS infrastructure and data systems.

4. Enterprise Architect – a minimum of 10 years of experience to understand and comply with a very large and complex enterprise architecture.

5. Security Manager – a minimum of 10 years of experience with, and certifications for, the Federal government’s security standards and processes.

1.7.2 COD, & NSLDS Key Personnel

The offeror shall propose key personnel for each system as follows:

1. Program Manager – a minimum of 5 years of experience and training and certification in managing large IT programs and related staff, with a special focus on data systems (vs application systems).

2. Operations Manager – a minimum of 5 years of experience and certifications in ITIL-based operation and maintenance of AWS infrastructure and systems.

3. Security Manager – a minimum of 10 years of experience with, and certifications for, the Federal government’s security standards and processes.

Controlled Unclassified Information (CUI) 13 11/30/2023

4. Data Quality Manager – a minimum of 10 years of experience with developing, analyzing, and running specialized queries and custom programs in fulfillment of data requests.

5. Development Manager -- a minimum of 10 years of experience in leading and performing standard development lifecycle activities, from requirements definition through design, testing, and post-production validation. Ensures quality assurance is performed for work items and deliverables.

6. Test Manager – a minimum of 10 years of experience as a Test Manager with at least 3 years of experience managing a team. Additionally, experience with organizing, planning, coordinating, and controlling the testing process and activities; developing, and defining suitable test methods and tools; leading, managing, and hiring the testing team; documenting, and preparing the test results and reports; and defining and monitoring the quality goals and ensuring high-quality products.

7. Training Manager - overseeing training for both systems with at least 5 years of experience and training in writing, editing, posting, and updating content for systems and websites. Utilizes content management software to publish online content, leading, and training a team of writers, and managing discussion posts on a company's website or blog. Conducts usability reviews.

1.7.3 Partner Customer Service Key Personnel

The offeror shall propose key personnel for the following:

1. Program Manager – a minimum of 5 years of experience and training and certification in managing large IT programs and related staff, with a special focus on data systems (vs application systems).

2. Command Center Manager – a minimum of 5 years of experience with overseeing and monitoring call center teams. Provides training to Call Center Team and feedback to FSA about the performance of the Call Center teams. Optimize operations and boost customer satisfaction based on effective call center monitoring strategies.

3. Security Manager – a minimum of 10 years of experience with, and certifications for, the Federal government’s security standards and processes.

4. Data Quality Manager – a minimum of 10 years of experience with developing, analyzing, and running specialized queries and custom programs in fulfillment of FSA data requests.

5. Training Manager – a minimum of 5 years of experience and training in writing, editing, posting, and updating content on FSA's websites, researching, and sourcing information, using content management software to publish online content, leading, and training a team of writers, and managing discussion posts on a company's website or blog.

1.8 Period of Performance

The transition period (where the current systems and the TIVOD Solution may be operated concurrently) will begin after the contract is awarded.

It is anticipated the follow-on contract will include a COD period of performance of (1) one-year base period and five

(5) one-year option periods, Data Management Solution period of performance of (1) one-year base period and three

(3) one-year option periods and Customer Service - Partner period of performance of (1) one-year base period and three (3) one-year option periods. The applicable North American Industry Classification System (NAICS) code for this procurement is 541512.

Controlled Unclassified Information (CUI) 14 11/30/2023

1.9 Place of Performance

The Contractor shall be expected to support the Government in locations within the United States of America.

Alternate Place of Performance - Contingency Only. As determined by the Contracting Officer’s Representative (COR) in conjunction with the Contracting Officer (CO), Contractor employees may be required to work at an alternate place of performance (e.g., home, the Contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather, etc.). Non-emergency/non-essential Contractors shall not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing Contractor resources in the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the Contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

1.10 Applicable Documents

1.11 Performance Measures

The intent of the Service Level Agreements listed in Attachment 2 are to ensure FSA maintains and improves the operational stability of the application systems and platforms it has achieved to date. These Service Level Agreements (SLAs) represent operating standards. FSA will only consider formal written modifications when in the best interest of the government and the modification must be signed by FSA. If these SLAs are not achieved, the result will be documented in the Cyber Security Assessment and Management (CSAM) system.

Performance measures, listed within the attached documentation, must be included within the Contractor proposal with any changes redlined.

Document Ti t le Document Reference

Higher Education Act https://fsapartners.ed.gov/knowledge-center/fsa-handbook/2020- 2021/appendices/appx-g-higher-education-act-1965-table-contents-august-26-2020

Federal Acquisition Regulation (FAR) Refer to the current version of the FAR.

https://www.acquisition.gov/browse/index/far

Education Acquisition Regulation

(EDAR)

Department of Education Acquisition Regulations https://www2.ed.gov/policy/fund/reg/clibrary/edar.html

Department of Education Contractor Vetting Security Requirements https://www2.ed.gov/fund/contract/about/bsp.html

Department of Education Security and Privacy Requirements for IT Procurements https://www2.ed.gov/fund/contract/about/bsp.html

FSA Current State Architecture Attachment7

Master Acronym List Attachment 8 https://fsapartners.ed.gov/knowledge-center/fsa-handbook/2020-2021/appendices/appx-g-higher-education-act-1965-table-contents-august-26-2020 https://fsapartners.ed.gov/knowledge-center/fsa-handbook/2020-2021/appendices/appx-g-higher-education-act-1965-table-contents-august-26-2020 https://fsapartners.ed.gov/knowledge-center/fsa-handbook/2020-2021/appendices/appx-g-higher-education-act-1965-table-contents-august-26-2020 https://www.acquisition.gov/browse/index/far https://www2.ed.gov/policy/fund/reg/clibrary/edar.html https://www2.ed.gov/fund/contract/about/bsp.html

Controlled Unclassified Information (CUI) 15 11/30/2023

The Contractor management team performs standard activities to ensure the effectiveness of staff activities across teams and business areas. The management team is responsible for reporting overall team performance monthly through the creation of a comprehensive Performance Report. This report presents a continuous view of Service Level performance and is used to gauge the monthly Contractor incentives/disincentives for a given month. The Contractor is responsible for personnel management through employee on-boarding and orientation.

FSA Administration/Management supports the analysis of team performance through an annual lesson learned session with Contractors and Federal staff. In addition, Service level agreements are based on the completion of specific administrative activities, and the delivery of the artifacts to support the monthly performance report and which will be used to certify invoices. FSA monitors Contractor development performance through these service level agreements, as well as through quality assessment of other work deliverables.

Please see Attachment 2 for TIVOD System & Customer Service Transition SLAs.

2.0 Specific Requirements/Tasks

2.1 COD Business Requirements

Please see attachment 3 for COD Business Requirements

2.2 NSLDS Business Requirements

Please see attachment 4 for NSLDS Business Requirements

2.3 EDMAPS & EDWA, FTI Data Mart Requirements

Please see attachment 5 for EDMAPS, EDWA, & FTI Data Mart Business Requirements

2.4 Customer Service

Please see attachment 6 for Customer Service Requirements

3.0 Contractor Quality Assurance

Quality Control Plan

The Contractor shall ensure quality service is maintained throughout the life of the contract and shall prepare and implement (upon Government written approval) a Quality Control Plan. The plan shall reflect the Contractor’s overall approach, internal controls, and establishment of procedures for evaluating each service under the scope of this contract (who, method, how often), for reporting to the Government, for resolving deficiencies, for identifying potential improvements, and for maintaining and making available to the Government, documentation (as listed in Deliverables Section) reflecting quality control inspections and any corrective actions taken.

• FAR 52.246-4 Inspection of Services-Fixed-Price (AUG 1996)

• FSA uses the following clause, as part of FAR 52.212-4, when contracting for commercial products and services.

Controlled Unclassified Information (CUI) 16 11/30/2023

Inspection/Acceptance. The Contractor shall only tender for acceptance those items conforming to the requirements of this contract. The Government reserves the right to inspect or test any supplies or services tendered for acceptance. The Government may require repair or replacement of nonconforming supplies or reperformance of nonconforming services at no increase in contract price. If repair/replacement or reperformance will not correct the defects or is not possible, the Government may seek an equitable price reduction or adequate consideration for acceptance of nonconforming supplies or services. The Government must exercise its post-acceptance rights-

1. Within a reasonable time after the defect was discovered or should have been discovered; and

2. Before any substantial change occurs in the condition of the item unless the change is due to the defect in the item.

4.0 Deliverables

Timely submission of deliverables and reports is essential to successfully completing this requirement. Schedules for deliverables will be provided as a separate attachment in Phase II. All deliverables shall be prepared and submitted according to media, content, and schedule described in the table.

Notice to Contractors:

All information and data related to this project the Contractor gathers or obtains shall be protected from unauthorized release. The Contracting Officer will be the sole authorized official to release verbally or in writing, any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this contract. Press releases, marketing material, or any other printed or electronic documentation related to this project, must not be publicized without the written approval of the Contracting Officer.

5.0 Meetings

For all meetings, the Contractor shall be responsible for recording meeting minutes and delivering meeting materials and providing administrative and facilitation support. Meetings will be conducted at a designated FSA location within the United States or through an alternative method of communication (such as a teleconferencing), as approved in writing by the CO.

5.1 Post-award Kickoff Meeting

Within 10 business days of contract award, the Government will conduct a post-award kickoff meeting with specific location, date, and time to be mutually agreed-upon in writing.

5.2 Intermittent Project Status Meetings

At the sole discretion of the Government, intermittent project status meetings may be conducted on an informal basis (by telephone or teleconference) or in person with 3 business days advance notice, as approved by the Contracting Officer or other authorized official at FSA as applicable, e.g., COR or Program Manager.

Controlled Unclassified Information (CUI) 17 11/30/2023

5.3 Monthly Project Status Meetings

Monthly status meetings to be conducted on the first Monday of each month. The Contractor is responsible for reporting the previous month’s activities (including any risks, issues, or concerns, and actual or recommended actions for their mitigation), and projected activities for the following month.

5.4 Program Management Meetings

The Government will conduct weekly program management meetings to review the progress of the program, identify any risks, issues, or concerns, and provide feedback on the Contractor’s progress and performance. The Contractor shall provide written data and verbal presentations to the financial status of the TIVOD System and Partner Customer Service Transition program.

6.0 Required Travel and Other Direct Costs (ODCs)

The principal place of performance is a designated FSA location within the United States. Accordingly, reimbursable travel and per diem for the Contractor’s employees performing work on a regular basis at this place of performance is not authorized. Any changes to this must be approved in advance in writing by the Contracting Officer.

7.0 Government Furnished Property/Equipment/Information

For a Contractor using a Government Furnished Equipment (GFE) Laptop, the user shall use the Department provided VPN solution(s).

In managing government furnished equipment, including but not limited to laptop computers and hardware security tokens; the Contractor shall comply with FAR clause 52.245-1 Government Property and FSA local clause 45-1 Special Contract Requirements for Government Furnished Property – Two Factor Authentication Tokens (TFA).

All Contractors accessing ED and FSA networks and/or data centers who are classified as Privileged Users (PU) are required to use government furnished Personal Identity Verification (PIV) cards for authentication and access. Note:

FSA prohibits Contractors from granting access to FSA’s systems without approval by the Department.

8.0 IT Standards and Guidelines

Department of Education Security and Privacy Requirements https://www2.ed.gov/fund/contract/about/bsp.html

General Department Information Security and Privacy Requirements

EDAR 3452.239-71 (DEVIATION) (NOV 2022)

Federal zero trust architecture (ZTA) OMB M-22-09 IT Disposal Requirements NIST publication 800-88 Internet access via TIC or MTIPS OMB Memorandum M-19-26, Update to the Trusted

Internet Connections (TIC) Initiative, September 12, 2019.

Identity Assurance Level (IAL3) and Authentication Assurance Level 3 (AAL3)

NIST SP 800-63-3

Controlled Unclassified Information (CUI) 18 11/30/2023

Supply Chain Management Conformance OMB M22-18 NIST Software Attestation Federal records • Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), 36 CFR Chapter XII Subchapter B, and the Privacy Act of 1974 (5 U.S.C. 552a)

• Federal Records Act 44 U.S.C. § 3301 Controlled Unclassified information EO 13556, 32 CFR Part 2002, ED Directive OCIO 3-113, and NIST-800-171 Revision 2 (or current version) Record Keeping 36 CFR 1236.20

32 CFR 2002.14(g) Handling and Safeguarding Requirements 32 CFR 2002.14(a-e) Artificial Intelligence • Executive Order 13859: Maintaining American

Leadership in Artificial Intelligence (February 11, 2019)

• OMB M-21-06: Guidance for Regulation of Artificial Intelligence Applications (November 17, 2020)

• Executive Order 13960: Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government (December 3, 2020)

• NIST AI-100-1: Artificial Intelligence Risk Management Framework (AIRMF1.0) (January 2023)

• Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (October 30, 2023)

• Department of Education guidance: Initial Cybersecurity Standard for Usage of Artificial Intelligence (AI) at the Department (October 31, 2023)

• Draft Policy Guidance on U.S. Government Use of AI.

More details on this policy, which is currently available for public comment, can be found at ai.gov/input and https://ai.gov/wp-content/uploads/2023/11/AI-in- Government-Memo-Public-Comment.pdf

IT Accessibility Requirements • Section 508 of the Rehabilitation Act, as amended by P.L. 105-220

• Revised 508 Standards, at 36 C.F.R. § 1194.1 & Apps. A, C & D. https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://ai.gov/wp-content/uploads/2023/11/AI-in-Government-Memo-Public-Comment.pdf https://ai.gov/wp-content/uploads/2023/11/AI-in-Government-Memo-Public-Comment.pdf https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines