Cloud Hosting IES- Statement of Work Recompete.docx

Statement of Work Version Date: 3/27/2026

STATEMENT OF WORK

Cloud Hosting, System Administration, and Website Support and Development for the Institute of Education Sciences

Background The Institute of Education Sciences (IES) of the U.S. Department of Education currently maintains a virtual data center hosted in Amazon Web Services (AWS). The virtual data center consists of approximately 70 virtual servers, most of which are a version of Windows Server. The primary function of the data center is to host survey collection and dissemination websites in support of IES’ mission. This includes web servers, database servers, a vast array of websites and data driven web applications, a system management and web development environment, terminal servers housing analytical and statistical software, and other system support servers. Support for all aspects of IES’ web operations, including system administration, website administration and critical feature development, and user, staff and developer support, is provided by a team within IES which is comprised of government and contractor staff.

Scope of Work The objective of this Statement of Work is to acquire the services of a Contractor to provide:

· Access to Amazon Web Services, Infrastructure-as-a-Service (IaaS)

· System operations and security support staff

· Website administration and development staff

· System, security, and analytical software

Period of Performance

Requirements Amazon Web Services (AWS)/IaaS Solution The contractor shall provide a cost-effective infrastructure hosted in AWS GovCloud-West and US-East regions that meets Federal IT security requirements and utilizes industry standards and best practices that meet or exceed the following criteria.

Subtask 1.1 Transition AWS Ownership from Incumbent Contractor (Base Year Only) The contractor shall assume AWS account ownership from incumbent contractor, including gaining full control of all IES owned system resources and accounts hosted in AWS that comprise the IES Data Center. This is expected to take no longer than 4 weeks.

Subtask 1.2 Provide AWS Cloud Services Responsive to Usage Demands In the base year, and in all subsequent option years, the contractor shall

a. Provide AWS cloud services that are currently utilized in the IES Data Center, as well as providing the ability to expand AWS services as usage demands change over time.

b. Provide access to AWS cloud services that meets or exceeds Federal Information Security Management Act (FISMA) requirements for information systems categorized as FIPS-199 defined Moderate and complies with the Federal Risk and Authorization Management Process (FedRAMP) requirements.

c. Provide a solution that shall be physically located in the continental United States, and in a facility capable of being certified and accredited to host U.S. Government systems.

d. Provide a robust, fault tolerant infrastructure that allows for high availability of 99.9%, and a one (1) hour recovery time after failure.

e. Provide technical documentation required for certification and accreditation.

System Operations and Security Support The Contractor shall provide system operations support staff, able to perform their work off-site. Support staff shall have experience working with systems in a federal owned data center and demonstrate an understanding through past performance of government IT mandates, regulations, and best practices. Support staff shall have demonstrated experience with and have strong understanding of privacy concerns of federal statistical agencies in respect to handling of sensitive data, including system security and storage, and limiting access to systems with sensitive data through network, system, and user policies.

The Contractor shall provide separate operations and security teams, with a dedicated project manager for each team. The Operations Team shall focus on maintaining the IES websites, databases, server environment, AWS services, and daily operations. The Security Team shall focus on security related issues, such as web application, database, and system security scans, network security management, log management, and security documentation and reporting.

Subtask 2.1: Transition Software Licensing Agreements and AWS Accounts (Base Year Only) The contractor shall transition custody of all IES owned software licensing agreements and AWS accounts including all IES hosting assets from the incumbent.

Subtask 2.2: Manage the IES Virtual Data Center The contractor shall:

a. Manage all aspects of the IES virtual data center hosted in AWS GovCloud-West and US-East regions, which includes:

· Managing virtual private network, including VPCs, subnets, ACLs, security groups, route tables, IP address allocation, Direct Connect, and DNS.

· Provisioning and maintaining virtual servers, including server resource allocation, storage, and network resources.

· Performing disaster recovery and incident response activities, including server backups and drive snapshots, AWS Cloud Trail monitoring, system redundancy, and monitoring the AWS FedRamp package for FISMA compliance monthly.

· Managing and routinely auditing security and access policies to all AWS resources, including IAM user accounts, groups, and policies, and certificate and key management.

· Maintaining MTIPS connectivity and internet routing to AWS network.

b. Manage all IES servers by providing technical expertise in:

· Microsoft Windows Server 2016, 2019, 2022, and 2025, including configuring system to align with organization baseline security standards and other security standards such as DISA Security Technical Implementation Guides (STIG).

· Microsoft SQL Server, including database maintenance, backups, restores, index creation and maintenance, data migration, management of large databases, and security.

· Microsoft Internet Information Services (IIS), including application configuration, migration, and security.

· Future versions of Microsoft Windows Server, Microsoft SQL Server, and IIS.

· Linux server management.

· Drupal system management.

· AWS data lake, search, and serverless technology support.

c. Manage the production and development infrastructure, restore infrastructure operational capabilities during disaster recovery efforts, and perform daily backups.

d. Perform system maintenance, including:

· System patch management using Windows Server Update Services (WSUS)

· Software inventory monitoring for updates, patches, and vulnerabilities

· Trellix ePO management (anti-virus and HIPS)

· Log management and analysis

· Vulnerability scans and remediation

· Microsoft Active Directory management, including creating user, groups, policies

· Storage maintenance, including clearing up space, removing redundant data, and scaling capacity as needed.

Subtask 2.3: Ensure System Security and Compliance with Federal IT Regulations The contractor shall:

a. Implement best practices and procedures in compliance with current and future U.S. Federal Government IT mandates and regulations, such as:

· Federal Information Security Management Act (FISMA) of 2014

· Federal Information Processing Standard (FIPS) 140-3

· Office of Management and Budget (OMB) Circular A-130 Appendix III

· Homeland Security Presidential Directives (HSPD)

· National Institute of Standards and Technology (NIST) standards and guidance

· Section 508 of the Rehabilitation Act (29 U.S.C. '794 d)

b. Track due dates for OCIO IT security data calls and supply data call responses to the IES ISSO.

c. Perform vulnerability research, and vulnerability remediation on IES systems.

d. Maintain FISMA compliance at the FIPS Moderate level including continuous monitoring, FISMA quarterly audits, and checking GRCT artifacts.

e. Provide an annual review and updates of all FISMA documentation (e.g. System Security Plan, Disaster Recovery Plan, Configuration Management Plan, Business Impact Analysis, Incident Response Plan, Contingency Plan) and update documentation when new templates are released by OCIO. Create and maintain IES system Standard Operating Procedures (SOPs).

f. Maintain IES Data Center system information and Plan of Action and Milestones (POA&M) in the Department of Justice Governance Risk and Compliance Tool (GRCT) system. Provide monthly updates for each open POA&M. Research and close POA&Ms.

g. Monitor due dates in the Governance Risk and Compliance Tool (GRCT) and track the progress of IES system updates to make sure GRCT information is current.

h. Perform annual tests of the Disaster Recovery Plan, Contingency Plan, and Incident Response Plan. Results shall be provided to the ISSO and system owner.

i. Help IES systems comply with OMB Memo M-21-31 “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents”.

j. Create, track and annually update IES system memorandums of understanding (MOUs).

Subtask 2.4: Support Day-to-Day Website Management

The contractor shall:

a. Manage all IES websites, databases, and support IES web developers and staff. This includes, but not limited to, website troubleshooting, database maintenance, application and file migration, share access, and user account management.

b. Manage F5 Big-IP network load balancers, including creating rules, virtual servers, VPN access and Single Sign On via Access Policy Manager, and installing SSL certificates.

c. Support IES Digital Modernization (IESDM) project, which includes maintenance of AWS infrastructure, servers and services required for ongoing IESDM activities, building and maintaining Linux servers, and supporting Drupal services, AWS serverless services, and other software used in the IESDM.

d. Act as technical point of contact for IES hosted systems and related issues for IES Government and contractor staff. Support hours are 7:30 AM – 5:30 PM EST. Staff may stagger their work schedule to provide adequate coverage during support hours. To minimize impact on users and program activities, it may be necessary to perform some maintenance activities outside of support hours.

Subtask 2.5: Support Software and Applications Used in IES Systems The contractor shall:

a. Provide software attestation/software bill of materials (SBOM) support for software used in IES systems to maintain compliance with OMB M-22-18 and M-23-16. Update IES system information in the CISA Repository for Software Attestations and Artifacts.

b. Submit Enterprise Architecture Technology Insertion (EATI) requests for new software.

c. Support the following software and applications:

· Apache SOLR

· ArcGIS

· AWS Management Console Resources (VPC, EC2, S3, Route 53, Direct Connect, Cloud Watch, Cloud Front, API Gateway, IAM, and SNS)

· Big Fix Inventory

· Big Fix Remediate

· Cloudberry

· F5 BigIP (LTM, APM, AFM)

· Fileup

· Fortify Static Code Analyzer

· Microsoft Active Directory

· Microsoft ASP, ASP.NET, .NET Core

· Microsoft Internet Information Services (IIS)

· Microsoft Office 2019

· Microsoft Remote Desktop 2019, 2022 Cals

· Microsoft Sharepoint

· Microsoft SQL Server

· Microsoft Team Foundation Server

· Microsoft Visio

· Microsoft Visual Studio

· Nagios Log Server

· PA Monitor

· R for Windows

· Redgate (SQL Compare, SQL Data Compare, SQL Backup)

· Redgate SQL Monitor

· SAS

· Sata/MP4

· Solarwinds Serv-U

· SPSS

· Stat/ Transfer

· SUDAAN

· Tenable SC Plus

· Trellix ePO

· Trustwave DB Protect

· Ubuntu Linux (via AWS subscription)

· Webinspect

· Windows Server Update Services (WSUS)

· Winzip

· Drupal

· Additional software as necessary

Website Administration and Development The contractor shall provide website administration and development staff, able to perform their work off-site. The contractor shall provide support, administration, and improvements for IES’ dissemination and survey collection websites; ensure that the websites IES hosts comply with standards, agency and federal regulations, and industry best practices; take the lead in developing and maintaining the technical standards that ensure the quality of products disseminated on the websites; consult and advise on technical issues and standards implementation related to the websites; maintain and update website architecture as needed to ensure continued high quality services; and critical development of system features to improve workflow and provide better service to the public and other federal agencies. Legacy application web development work is in .NET, .NET core, or Classic ASP. The modernized website is built using Drupal. The contractor shall provide all deliverables in electronic formats and provide all computer programming source files and code used in the creation of deliverables.

Subtask 3.1 Ensure IES Websites are Compliant with New and Existing Standards The contractor shall:

a. Review all new and existing web content for standards compliance, updating technical standards to align with changing industry standards, federal laws, and agency policies, providing technical support to staff and contractors, answer user submitted questions, publish new content to the website, convert print publications to web format, update and improve existing data dissemination tools, and collaborate with the Digital Modernization team to improve overall website architecture and design.

b. Continually update IES’ web development standards with new specifications and remove obsolete standards to be current and align with industry, agency, and federal standards.

c. Follow the IES digital design system and IES identify guidelines, including updated branding guidelines, design specification, components and templates

Subtask 3.2 Provide Technical Support The contractor shall:

a. Provide technical support to staff and contracts on all matters related to the IES websites, including providing assistance with meeting standards, developing tutorials related to web publishing, answering technical questions about website and server infrastructure and system limitations, providing web analytics support, and assisting the server operations team with application issues and technical guidance.

Subtask 3.3. Manage and Support IES Members Site and Intranet The contractor shall:

a. Update and maintain existing tools on the IES Members Site such as the request management system, web publication system, calendar and conference tools, Newsflash system, and secure file transfer system, and create new website management and workflow improvement tools as needed.

b. Continually monitor the request system for new submissions (~500 requests per month in the base year and first three option years; ~100 requests per month in the fourth option year), review new requests to ensure they are correctly formatted and categorized, and establish priority of each request based on time of release or severity if the request is to correct an issue on a live website

c. Maintain the Review Tracking System (RTS) application on the IES intranet site to improve performance and to facilitate electronic publication tracking of IES publications and data products.

Subtask 3.4 Support Updating and Maintenance of Content and Data on the IES Website The contractor shall:

a. Use the IES content management system (CMS) when publishing content and must follow the CMS user guide(s) for publishing procedures and taxonomy guidance, including required CMS fields and tagging of universal taxonomy terms.

b. Update IES’ websites with content provided by IES staff to ensure that the websites stay current with the latest information, as needed. Examples of updated content includes but is not limited to: updating and adding new conferences and trainings, updating the publication release calendar, posting new What’s New, Highlights, and Data Snapshots items to the homepage, adding and removing IES staff listings, posting Director and Commissioners’ remarks and press releases, processing publication requests, and updating site navigation and site map. The contractor shall also send “Newsflash” emails upon request, which occur on average 3-5 times a week. The Newsflash content and designated audience will be provided by IES staff.

c. Update the content on the various survey and program area sections and create new survey and program areas sections as needed.

d. Maintain and update websites for IES (http://ies.ed.gov) This work includes, but is not limited to, posting new publications and content to IES websites, adding new grants/funding information, updating the grants database with detailed grants and grant program descriptions, principal investigators, and other details, and posting webinars. The Regional Educational Laboratory Program (REL) website (https://ies.ed.gov/use-work/regional-educational-laboratories-rel) has additional needs including adding new publications and projects to the REL pages and maintaining the information on the various RELs.

e. Convert publications specifically selected by IES staff into a suitable web format. Some of the publications include, but are not limited to, Condition of Education (http://nces.ed.gov/programs/coe/), Digest of Education Statistics (http://nces.ed.gov/programs/digest/), and Projections of Education Statistics (http://nces.ed.gov/programs/projections/). This process entails creating html and image files that meet IES and NCES standards, converting tables into accessible html tables, creating navigation based off publication table of contents, and creating and optimizing graphics.

f. Publish new content provided by NCES and other Forum participants to the Childstats.gov website, including updating and creating new HTML and image files.

g. The contractor shall provide maintenance and critical development of features for applications which do not currently have active support contracts. Support may include:

· Bug fixes to identify and correct known work stoppage issues

· Compatibility updates due to ongoing maintenance in the environment (e.g., .Net, OS, or java updates)

· Remediation of vulnerability scan or compliance findings which are time sensitive

· Limited scope, urgent feature updates needed for operational continuity

· Adapting existing code to remediate identified risks where gaps in application support need to be bridged

· Research and document existing web applications in order to support GRCT and the generation of requirements for new support contracts when previous resources are no longer available

· All work must be limited in scope and duration to stay within the existing architecture and not evolve into full project development.

In the monthly report, the contractor will submit a list of the most pressing applications to support, the type of support needed, estimated level of effort, and progress to date. The COR shall provide technical direction about the priority of items on the list and which applications to support in the upcoming month.

Subtask 3.5. Update Dissemination Tools The contractor shall:

a. Update dissemination tools to use the most recently available data and improve those search tools by adding new features requested by IES program staff. The tools to be updated include, but are not limited to: College Navigator (http://nces.ed.gov/collegenavigator/).

b. Support existing tools and websites and release new tools, including REL toolkits, publications, and web content. This shall include ensuring that the REL toolkits are successfully deployed, and that the websites are developed with the functionality needed.

c. Update and improve the ERIC dissemination website (https://eric.ed.gov) and backend data management tools. These web-based applications were developed using ASP.NET (C#), Apache SOLR, SQL Server, and AWS S3.

Subtask 3.6 Ensure Compliance of Website Content with Federal Regulations The contractor shall:

a. Review new and existing content to ensure that the products released on the IES-hosted websites, including REL products, and the websites themselves, meet federal regulations (including but not limited to Section 508 of the Rehabilitation Act (https://www.access-board.gov/ict/), industry standards and best practices, and documented IES style and technical standards. In addition to meeting standards, the contractor shall test new web applications for performance, usability, and functionality.

b. Take existing word and PDF documents produced by IES and their contractors and develop them into 508 compliant documents or website text. This may include laying out in InDesign, formatting them to comply with IES style guides, adding alternative text, tagging for accessibility, and formatting of tables.

On a rolling basis, the COR will send the contractor a given document or set of documents and their priority. The contractor will develop an estimated level of effort in terms of labor hours. In the monthly report, the contractor shall submit a list of the content to make 508 compliant, the estimated level of effort, and progress to date. The COR shall provide technical direction about the priority of items on the list.

Subtask 3.7 Coordination with IES Contractors Supporting IT and Data The contractor shall:

a. Respond to user questions related to the websites or refer questions to appropriate IES staff members based on subject matter of the question and the area or expertise of the staff. Responses shall be provided within one business day on average.

b. Maintain the common website framework established through the IES Digital Modernization effort in Drupal to ensure that the established standard look, menu and search elements are supported and updated as necessary improving standards compliance and performance. The contractor will coordinate with the IES Digital Modernization contractor to identify and support needed updates and critical feature improvements to the website.

c. Plan to meet and communicate with DM-related vendors and/or work with the DM implementation vendor as directed by the COR.

Software Licenses The contractor shall provide system and software licenses allowing for additional functionality in support of IES’ cloud hosted systems. The software and software licensing to be purchased for the base year and subsequent option years:

Additional software as necessary

Surge Task for Amazon Web Services (AWS)/IaaS Solution (Optional) This optional task provides IES with the ability to secure additional servers when current load exceeds the capacity of existing servers being supported via Task 1 of this PWS. All requirements, standards, and procedures set forth in Task 1 apply in full to this surge work unless otherwise specified by the COR.

Subtask 5.1 Pricing Surge support shall be priced as separate unit-priced tasks corresponding to each surge additional server need to meet load requirements. The contractor shall propose unit pricing for each task based on the full cost of acquiring an additional server. Unit pricing shall be fully loaded and reflect all labor, subcontractor costs, and overhead associated with setting up and maintaining the additional server.Surge Task for Technical Systems or Website Administration Support (Optional) This optional task provides IES with the ability to secure additional contractor support when the volume of technical systems and website administration support exceeds support provided by this contract. In the rapidly evolving cybersecurity environment, including the unpredictable deployment of automated webscraping tools and other AI-powered bots, demands on the IESDC security and operations team may periodically exceed planned capacity. At the same time, as IES consolidates website support into a centralized contract, IES anticipates that they may need to exercise this option to provide additional technical and security support for websites previously supported by other contracts. In addition, IES is currently undergoing an agency-wide digital modernization (DM) to rebuild its digital portfolio. This includes the launch of a new ies.ed.gov website in FY2025 Q1 and the migration of existing content and data to the new website. This ongoing effort may require additional personnel effort to support migration of content into the existing CMS. This optional task provides IES with the ability to secure additional personnel effort to support the migration of content into the CMS, as well as FTE from personnel with expertise in Drupal when the current contracted support for digital modernization ends. All requirements, standards, and procedures set forth in Tasks 2 and 3 of this PWS apply in full to surge work unless otherwise specified by the COR.

6.1 Surge Triggers. IES may exercise this optional task when any of the following thresholds are exceeded in a given fiscal year:

· New security and system requirements are established that require additional staff expertise.

· Critical website technical support is required that exceeds what is provided.

· Externally imposed and new deadlines (e.g., established in annual appropriations or report language) require more capacity to migrate content from existing nces.ed.gov websites to the ies.ed.gov CMS.

· Accelerated timelines are established for migrating content and data from existing nces.ed.gov websites to the ies.ed.gov CMS.

Each threshold operates independently. IES may exercise surge support for one or more triggers simultaneously as conditions warrant.

6.2 Pricing. Surge support shall be priced as separate unit-priced tasks corresponding to each surge trigger identified in 6.1. The contractor shall propose unit pricing for each task based on the full cost of performing all applicable subtasks under Task 2 through 3 for each additional unit. Unit pricing shall be fully loaded and reflect all labor, materials, subcontractor costs, and overhead associated with the additional work.

6.3 Exercise of Surge Support. IES will provide the contractor with no less than 30 calendar days written notice prior to exercising surge support under this task. When operational circumstances make 30 days advance notice impracticable — including but not limited to critical cybersecurity concerns or external schedule demands outside of IES control (e.g., for a data collection tool hosted on the IESDC server but managed by another contract team) — IES may provide shorter notice with the mutual written agreement of the contractor.

Schedule Deliverables

Base Year

Invoicing The contractor shall submit monthly reports on or before the 10th of each month. The monthly reports are to be submitted via electronic transmission. The monthly report shall be submitted to the COR, appointed Task Leader, and Contract Specialist.

The report shall include the following:

a) The progress on each task and activity relative to the schedule and a discussion of discrepancies;

b) Accomplishments associated with each task and activity for the month;

c) Problems that have been resolved or are in need of resolution;

d) A discussion of the work to be performed during the next monthly reporting period;

e) Brief description of the work performed by each staff member during the month;

f) Detailed breakdown of cloud hosting spending;

g) Funding expended by major category, including staff, travel, consultant, subcontractors, and other costs, including obligated costs of subcontractors; and

h) Expected future technical and budgetary problems and proposed solutions to these.

Confidentiality, Security, IT & Other Requirements Staffing The contractor shall provide in writing at least two (2) weeks advanced notice for replacement of staff proposed. This notice shall be provided to the Task Leader, COR and Contracting Officer (CO) and shall include justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on the program. All resumes of proposed replacement staff must be provided and approved by the COR and Task Leader before replacing any individual on this project.

The work contained within this solicitation is classified as High Risk, and all proposed staff must be able to be determined suitable for 6C – High Risk – Public Trust positions.

Due to U.S. Department of Education policy, only U.S citizens will be eligible for employment on contracts requiring a Moderate Risk/Public Trust, a High Risk/Public Trust, or a National Security designation.

Government Furnished Equipment The Government will not supply equipment for this contract. The contractor is expected to provide all necessary equipment (laptops, workstations, PIV card readers, etc) to perform the activities detailed in this SOW.

Contractor Employee Security Screening Requirements The Department has established policy on personnel security screening for all contractor and subcontractor employees and their field staff. The relevant Departmental Directive is OM:5-101. It was last updated in July 2010 and can be found on the Department website:

http://www2.ed.gov/policy/gen/leg/foia/acsom5101.pdf The contractor must comply with the personnel security-screening requirements in OM:5-101 throughout the life of the contract.

All contractor and subcontractor employees must undergo personnel security screening if they will be employed for thirty (30) days or more.

The type of screening and the timing of the screening will depend upon the nature of the contractor position, the type of data the contractor employee will have access to, or the type of Departmental information technology (IT) system they will access. Personnel security screenings will be commensurate with the risk and magnitude of harm the individual could cause to the Department or the public. A position risk level will be assigned to each contractor employee position, before a solicitation is released, consistent with the descriptions in Appendix I of OM:5-101. Hence, each contractor employee working on this contract must be assigned a position risk level. Depending on the risk level assigned to each person's position, a follow-up background investigation by the Office of Personnel Management (OPM) may occur.

The contractor must identify one of their employees as a security liaison for this process. This Contractor Security Liaison coordinates the distribution, collection, and dissemination of various forms required in this process. They answer general questions from their employees on completing the security screening process. And, they are the first point of contact for contractor employees in using the OPM’s Internet based security screening portal called e-QIP (http://www.opm.gov/e-qip/). The contractor is also responsible for ensuring that all subcontractors follow these personnel security screening procedures.

IES requires each contractor employee to have or apply for a clearance for the security level designated for the position held on a contract.

Contractor employees who have undergone appropriate personnel security screening for another Federal agency will be required to submit proof of that personnel security screening for validation. For these employees, the contractor or subcontractor must follow these required steps:

1. The contractor must send the IES Security Representative a letter on Company letterhead that lists the full name of each employee with a pre-existing clearance, the agency that cleared the employee, the level of the clearance, and the date of the clearance. This letter must be transmitted within two (2) business days of starting work on an IES contract.

2. In those cases where any of the required information on level of clearance, agency that cleared the employee and date of clearance is not available, the contractor must send the IES Security Representative a letter on Company letterhead that lists the full name and Social Security Number for each employee with a pre-existing clearance. This letter must be transmitted within two (2) business days of starting work on an IES contract.

3. The IES Security Representative reviews the letter to ensure that the required information is provided and either returns it to the contractor for completion or releases it to the Office of Finance and Operations. The contractor must resubmit the letter to the IES Security Representative within 7 business days or the contractor employee must be removed from the contract.

4. The IES Security Representative will notify the contractor or subcontractor if the pre-existing clearance was identified and ruled to be acceptable by the Office of Finance and Operations (OFO).

5. Those employees whose pre-existing clearances are not verified and approved must follow the process outlined next to apply for a security clearance.

For contractor employees who have not undergone appropriate personnel security screening for another Federal agency, all contractors must comply with the Principal Office (PO) Executive Office or Computer Security Officer’s pre-processing requirements for personnel security screening and granting access privileges. No contractor employees are permitted unsupervised access to unclassified sensitive information (i.e., personally identifiable information), direct access to respondents who are minors, or Department of Education IT systems until they have submitted applicable security screening documents.

For each contractor employee in a moderate risk level position the completed security screening documents must be accepted by the COR and the IES Security Representative within 14 days of the date the contractor employee starts working on the contract. In order to meet this Departmental requirement, steps 1 through 7 must be completed within 14 days of the date the contractor employee starts working on the contract. To meet this 14 day deadline and the interim deadlines specified below, it is strongly recommended that the contractor request the account initiation three (3) weeks before the contractor employee starts contract work and encourage each contractor employee to complete all required security screening forms before starting contract work.

Contractor employees in High Risk IT (6C) Level positions require preliminary personnel security screenings before they are given access to unclassified sensitive information or Department of Education IT systems (see page 7 of OM:5-101 for more details).

The security screening of contractor and subcontractor employees not holding Department of Education recognized security screening credentials must follow these required steps:

1. The contractor must provide the COR with an electronic listing of all employees on a specific contract, with the risk level associated with the position held by each employee as specified in the contract solicitation. The COR will review the electronic listing for completeness and approve. The listing will not be approved if it is found to be incomplete.

2. The Department of Education participates in the OPM e-QIP system to facilitate the security screening process for contractor employees. IES will initiate an e-QIP account for each contractor employee. It is advisable to request the account initiation three (3) weeks before the contractor employee starts contract work. For the initiation of these accounts, the Contractor Security Liaison must use the COR-approved list of employees and the risk levels assigned to the employees’ positions to produce and submit the following list using the attached template:

a. For each contractor employee provide: Social Security Number, Full Name, Date of Birth, Place of Birth, risk level, e-Mail Address, and phone number. The Contractor Security Liaison must place the spreadsheet in a password protected file, then upload the list to the IES secure server, and send an e-mail notification of the transmission to the IES Security Representative. The IES security staff will use this list to establish the contactor employee e-QIP accounts. The COR will work with the contractor Liaison to establish access to the IES secure server at the outset of the contract.

b. Once IES sets up the e-QIP accounts for contract employees, the IES Security Representative will send an email to the Contractor Security Liaison stating that the employee has an active account on the e-QIP system. The COR is copied on this email notification.

c. The Contractor Security Liaison must notify their employees of this active account. A computer with Internet access and web browsing software is required for the contractor employee to access their e-QIP account. Each employee must log into their personal account in e-QIP, enter the requested information, finish the application process and print, sign, and date the e-QIP signature pages.

3. Each contractor employee must submit a completed set of security screening forms to their Contractor Security Liaison as provided by the IES Security Representative, including for example:

a. A copy of the SF85 prior to signing,

b. After approval of the SF85, the signed and dated e-QIP signature pages,

c. The Declaration of Federal Employment (OPM form OF-306),

d. The Fair Credit Release Form,

e. The Request for Security Officer Action (RSA) Form,

i. The contractor employee shall complete only those items in section 1 of the form (name, date of birth, place of birth, organization, position title, duty station, social security number, and work phone number).

ii. The contractor shall complete section 5 (Project Requiring Highest ADP Level) using the assigned security clearance for each employee’s position.

f. Two sets of fingerprints on separate copies of form FD-258,

i. The Contractor Security Liaison shall help arrange fingerprinting for each contractor and subcontractor employee. Fingerprinting can usually be done at a local police station. (Electronic fingerprints are not accepted at this time.)

4. Each contractor must ensure that the forms are complete and that all contractor employee required security screening forms are transmitted to the IES Security Representative within two (2) business days of an employee starting work on an IES contract.

a. The Contractor Security Liaison must collate the forms in each security screening package by employee. Until the Contractor Security Liaison has completed ICAM training, he or she must transmit a complete set of security screening documents for each employee to the IES Security Representative via courier (e.g., Federal Express) using a tracking number with signature required. Once ICAM training is completed, all eQIP related documents are required to be uploaded into ICAM by the Contractor Security Liaison. Once the documents have been uploaded, please submit the fingerprint cards with a copy of the RSA via secure mail (e.g. registered mail, or overnight express) to the below address:

ICAM Support Team/IES Security Representative U.S. Department of Education 550 12th Street SW, Room 4165 Washington, DC 20202

b. IES will not accept security screening packages that are not collated by employee (i.e., all forms noted in point 3 above will be bundled by employee). The IES Security Representative will review all security screening documents for each contractor employee for completeness, returning any incomplete security screening documents to the Contractor Security Liaison for completion. The contractor must resubmit the completed security screening documents to the to the IES Security Representative within 7 business days or the contractor employee must be removed from the contract. No contractor employees are permitted unsupervised access to unclassified sensitive information (personally identifiable information), direct access to respondents who are minors, or Department of Education IT systems until they have resubmitted applicable screening documents.

5. The IES Security Representative reviews each package of security screening documents and electronic information submission to ensure everything required has been provided and either rejects the package, sending it back to the submitter for completion/correction or prepares it for transmittal for final IES review. In the event that an application is rejected at this stage, the contractor must resubmit the corrected forms to the IES Security Representative, or have the contractor employee correct the e-QIP submission, within two business days. The IES Security Representative must be notified as soon as the updated e-QIP submission is completed.

6. The contractor employee application for each individual in a moderate risk level position must be submitted to the IES Security Representative within 14 days of the date the contractor employee starts working on the contract. Contractor employees in High Risk IT (6C) Level positions require preliminary personnel security screenings before they are given access to unclassified sensitive information or Department of Education IT systems.

7. After a package of security screening documents is transmitted for final review, IES security staff conduct a further review and either rejects the package of security screening documents, sending it back to the submitter for completion/correction or releases it to OPM.

8. OPM then assigns an investigator to conduct the type of investigation indicated by the department (this is tied to the level of access to PII that the applicant will have).

9. The Office of Finance and Operations will request the expansion of background investigations to obtain additional information to the extent necessary to make personnel acceptability or suitability determinations. These determinations will be made using criteria established by the OPM for the purpose of determining suitability for employment in the Federal competitive service, as described in 5 CFR 731.202, and other OPM guidance as applicable. The Office of Finance and Operations determines whether a contractor employee is acceptable for the position from a personnel security standpoint.

10. When the OPM investigation is complete, the RSA form with the clearance indicated is sent to the Department of Education’s Office of Finance and Operations for processing.

11. The Office of Finance and Operations returns the RSA form to the IES Security Representative for recordation and distribution to the COR.

12. The IES Security Representative transmits the RSA form with clearance indicated to the Contractor Security Liaison for their records and for distribution to the Contract Project Leader.

13. The Contract Project Leader then distributes copies of the clearance to the employee.

14. The Office of Finance and Operations will inform the IES Security Representative and the COR when he or she determines that a contractor employee is not acceptable to render service(s) or, if appropriate, to otherwise perform under a contract.

15. Each contractor will officially notify its contractor employee if he or she will no longer work on an Department of Education contract.

16. In the event a contractor employee is deemed unacceptable for the position from a personnel security standpoint, the Office of Finance and Operations will usually provide the contractor employee with an opportunity to refute, explain, clarify, or mitigate information in question.

17. If, after final determination by the Office of Finance and Operations, a decision is made that the contractor employee is not acceptable to render services on a contract and access is denied, the COR will inform the Contracting Officer. The Contracting Officer must inform the contractor (i.e. employing firm) that the contractor employee is not acceptable to render services in this particular position, or, if appropriate, to otherwise perform under the contract. The contractor will notify the contractor employee. A final determination cannot be appealed.

18. At any time during the life of the contract a contractor or subcontractor employee (including any field staff) discontinues work on the contract or leaves the employment of the contractor, the contractor shall notify the IES Security Representative and COR within two days of the date that the employee is no longer working on the contract or within one business day if removed for cause. The contractor shall provide the reason why the employee is no longer working on the contract.

19. Each contractor is responsible for the protection of sensitive or Privacy Act-protected information from unauthorized use or misuse by its employees, subcontractors, or temporary workers, and for preventing access to others, who are not authorized and have no need to know such information.

20. The contractor shall submit monthly information to the COR indicating which employees were billed to the contract that include the e-QIP number of the person being billed. The COR will reject payments to employees without an e-QIP number. For employees with pre-existing clearances from other contracts, this shall be noted on the monthly payment form.

The contractor shall verify with the COR that the security screening processes have not changed by the time the contract is active.

Confidentiality of Individuals and Institutions IES assures participating individuals and institutions that any data collected conforms to the IES standards for protecting the privacy of individuals as required by Section 183 of the Education Sciences Reform Act of 2002 (P.L. 107-279):

“. . . all collection, maintenance, use, and wide dissemination of data by the Institute, including each office, board, committee, and Center of the Institute, shall conform with the requirements of section 552A of Title 5, United States Code [which protects the confidentiality rights of individual respondents with regard to the data collected, reported, and published under this title].” (Section 183)

Under the Education Sciences Reform Act of 2002 (ESRA 2002), all individually identifiable information about students, their families, and their schools shall remain confidential. To this end, this law requires that no person may:

· Use any individually identifiable information furnished under the provisions of this section for any purpose other than statistical purposes for which it is supplied, except in the case of terrorism;

· Make any publication whereby the data furnished by any particular person under this section can be identified; or

· Permit anyone other than the individuals authorized by the Commissioner to examine individual reports.

Further, individually identifiable information is immune from legal process, and shall not, without the consent of the individual concerned, be admitted as evidence or used for any purpose in any action, suit, or other judicial or administrative proceeding, except in the case of terrorism. Employees, including temporary employees, or other persons who have sworn to observe the limitations imposed by this law, who knowingly publish or communicate any individually identifiable information will be subject to fines of up to $250,000 or up to 5 years in prison, or both (Class E felony).

Protection and Security of Data The confidentiality of individually identifiable information contained in project documents, data, and other information supplied by the Institute of Education Sciences, U.S. Department of Education (the Department) or information acquired in the course of performance under this contract where the information was furnished under the provisions of Section 183 of the Education Sciences Reform Act of 2002 is a material aspect of the contract and must be maintained, secured, and protected from disclosure as provided in Section 183. The Privacy Act of 1974 (5 U.S.C. 552a) also applies.

The contractor shall enforce strict procedures for assuring confidentiality. These procedures shall apply to all phases of the project and should include but not be limited to: information used to locate study respondents, data collection in the field, coding and editing phases of data prior to machine processing, safeguarding response documents, and maintenance of any respondent follow-up information. Contractor shall physically separate the identifying data required for any follow-up from data required for research purposes.

The contractor shall be familiar with and comply with:

1) The Privacy Act of 1974 (5 U.S.C. 552a), https://www.justice.gov/opcl/privacy-act-1974

2) Confidentiality Information Protection and Statistical Efficiency Act (CIPSEA) of 2002 (P.L. 107-347, Title V, Subtitle A, “Confidential Information Protection”), http://www.gpo.gov/fdsys/pkg/STATUTE-116/pdf/STATUTE-116-Pg2899.pdf

3) Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. 1232g; 34 CFR Part 99), https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html

4) The Freedom of Information Act (5…