DRAFT PWS SCE-SDAF.pdf

DRAFT Performance Work Statement

(PWS)

Secure Compute Environment (SCE) & Secure Data Access Facility (SDAF) Recompete

1.0 Requiring Organization

National Science Foundation Division of the National Center for Science and Engineering Statistics Directorate for Social, Behavioral and Economic Sciences 2415 Eisenhower Avenue Alexandria, VA 22314

2.0 Description of Services

2.1 Background

The National Center for Science and Engineering Statistics (NCSES) grants licenses to securely access restricted microdata files to approved researchers for approved statistical uses. To achieve these goals NCSES archives, maintains, disseminates and provides secure remote access to restricted-use data from the Survey of Earned Doctorates (SED) in the form of the Doctorates Records File (DRF), Survey of Doctorate Recipients (SDR), National Survey of College Graduates (NSCG), National Survey of Recent College Graduates (NSRCG), Early Career Doctorates Survey (ECDS), and Scientists and Engineers Statistical Data System (SESTAT) to authorized data users via remote access at a secure data access facility (SDAF) approved by the National Center for Science and Engineering Statistics. Currently the SDAF only contains NCSES survey data. However, this has the potential to be expanded to include linked datasets that NCSES is developing to expand our restricted data offerings to approved users, data from additional federal agencies to serve as a secure data enclave, and additional users to support a National Secure Data Service. Throughout this statement of work, “Data” refers to the potential collective data assets including NCSES data, NCSES linked data, and data from other federal agencies that could be included within the scope of this contract. This begins a phased, iterative approach starting with the development of an NCSES SDAF environment in the Base Year of the contract, and potentially evolving into the Secure Compute Environment (SCE) with enhanced capacity, compute power, and tools in Option Year 1 through 4.

The SCE builds on the functionality of the SDAF to create a comprehensive environment that can support multiple needs in a single upgraded environment. This SCE will continue to support both the NCSES restricted data licensing program as its core function but also support the National Secure Data Service Demonstration (NSDS-D) in its final years of its mandated 5-year demonstration, set to end in August of 2027. The NSDS-D was established by PL 117-162 to ‘develop, refine, and test models to inform the full implementation of the Commission on Evidence-Based Policymaking recommendation for a governmentwide data linkage and access infrastructure for statistical activities conducted for statistical purposes, as defined in chapter 35 of title 44, United States Code.’

The potential SCE analytical environment developed under this contract will serve as a bridge between the NSDS-D to the implementation of a National Secure Data Service (NSDS). The SCE will potentially implement additional requirements and tools, from the SDAF, to create a robust and comprehensive environment providing a restricted platform for a data access and linkage infrastructure for current and future evidence-building project s.

2.2 Scope

The purpose of this project is to design, deploy, and support a secure virtual data access environment that will be leveraged as part of an overall effort to build a linkage and access infrastructure to support the NCSES data licensing program and potentially the future NSDS and other agency data enclave needs.

A Secure Data Access Facility (SDAF) will be maintained throughout the contract, with the SDAF potentially transforming into an enhanced Secure Compute Environment, with expanded capabilities in the option years of the contract. While the SDAF currently houses NCSES data, the data assets potentially will be expanded to include linked NCSES data in the first year of the contract and data from additional federal agencies beginning in Option Year 1 and continuing through the completion of the contract. Additional functionality of SCE will be able to be added or removed based on the future needs of NCSES and the NSDS.

2.3 Statement of Work

2.3.1 Project Management

The contractor will provide project management to oversee the successful completion of all tasks in the statement of work.

2.3.1.1 Planning (roadmap)

Within 1 month after the contract has been awarded, the contractor must provide the Contracting Officer Representative (COR) a roadmap for this contract to include all of the tasks outlined below. The contractor will develop project-specific milestones and schedules. The contractor will provide written monthly progress reports to the COR on the status of NCSES’s desired milestones and goals. The contractor will provide quarterly and an annual virtual presentation to the COR and NCSES Leadership to outline past quarter/year outcomes and upcoming quarterly or yearly milestones and goals.

2.3.1.2 Risk management

The contractor will produce a risk management plan, will maintain and review projects, schedules and resources, and will report risks to the COR on a monthly or time-sensitive basis that impact the overall project and how to avoid and/or correct it. The written monthly risk report must include identification of risks, an assessment of probability of occurrence and impact, risk management, and risk reporting and monitoring.

2.3.1.3 Documentation

The contractor will draft and maintain technical documentation for all products developed in this project. Documentation must be delivered with every major product release and approved by the NCSES

COR.

2.3.1.4 Communication management

The contractor will propose and implement a communication plan outlining a communication protocol in at least the following areas: status meetings and reports, system documentation, system monitoring and reporting, and interacting and coordination with NCSES staff, contract-related personnel, and users of the SDAF/SCE environment, including those from additional agencies. As needed, the contractor will work with the COR and other key staff to suggest communication strategies to alert, inform, coordinate, update and brief NCSES staff, including Leadership, on any new or ongoing projects and initiatives. The communication plan will need to be delivered within the first 6 months of contract award. COR approval of the plan is required.

2.3.1.5 Financial management, resources and procurement of hardware and software The contractor will manage the contract budget and maintain a detailed financial record of their costs.

The contractor will propose a financial management plan, including a proposal for a monthly financial report to the COR. The monthly financial report will include, at a minimum, the monthly break-down of the current and cumulative expenses and other direct costs for the entirety of the contract. The financial management reports will be incorporated in the monthly, quarterly, and year-end deliverables.

The contractor will work with the COR and NCSES staff to identify requirements and manage the procurement of software and services needed for this work. The contractor will also propose a resource plan, included in the proposal submission, that includes staffing and other resources needed to achieve milestones goals and known projects as of the contract start date.

2.3.1.6 Security Clearances

To ensure compliance with all data confidentiality requirements, including the Confidential Information Protection and Statistical Efficiency Act (CIPSEA) of 2018, all contractors with access to the SDAF and SCE will be required to become designated CIPSEA agents and take annual CIPSEA training. Additional security requirements for contractors may be necessary depending on the data used within the environment. The contractor will provide documentation of annual completion of security requirements to the COR.

2.3.1.7 Transition

The Contractor must coordinate an orderly transition of the Secure Data Access Facility and Secure Compute Environment projects from the previous contractors during the time between award of this contract and expiration of the previous contract, for which the final option period is scheduled to end on December 31, 2025 and August 9, 2026, respectively.

The Contractor must:

(a) at the Contracting Officer’s Representative’s (COR’s) discretion, participate in five (5) or more meetings with the previous contractors to effect a smooth transition and to receive detailed information on the operation of SDAF and Secure Compute Environment;

(b) ensure receipt from the previous contractors or NCSES of complete documentation and all government furnished property, hardware, software, materials and data necessary to support continuation of full services, capabilities and outstanding technical and related work inherited from the previous contractors and promptly notify the COR of any omissions or deficiencies;

In addition, this task encompasses those planning and organizational efforts that lead to clear identification of the direction the project is heading and the activities encompassed by the project.

Project management includes internal Contractor management activities, as well as all forms of interaction and communication between the Contractor and NCSES.

2.3.2 Secure Data Access Facility

The Contractor will accomplish the following activities at a minimum to maintain the Secure Data Access Facility functions and capabilities.

2.3.2.1 Confidentiality Plan and Data Security Procedures (CPDSP) The data for inclusion in the SDAF includes but is not limited to surveys that collect and maintain personally identifiable information (name, address, date of birth) and confidential personal data (race, ethnicity, employment plans, salary, sources of educational support, etc.) that is collected under a pledge of confidentiality to respondents. In this statement of work, “individually identifiable information” refers to personally identifiable information and confidential personal data. Additional data may include linked datasets with survey, administrative, and third party or commercial data. Therefore, handling of the NCSES data and other confidential data (“Data”) by the contractor will require special confidentiality protections be applied.

The Contractor must be responsible for protecting the confidentiality of Data about individuals, as required by the Privacy Act of 1974, the NSF Act of 1950 as amended, and the Confidential Information Protection and Statistical Efficiency Act (CIPSEA) of 2018. The Contractor must also be subject to all federal (e.g., Federal Information Security Management Act (FISMA), Federal Information Processing Standards (FIPS)), NSF, and NCSES policies on confidentiality protection, as specified by the NCSES Chief Statistician and the NCSES Confidentiality Officer, regarding Data storage and access, and Data dissemination and analysis in the SDAF.1, 2 These policies may change during the period of the contract.

The Contractor must submit for review and approval by the COR, the NCSES Chief Statistician, and the NCSES Confidentiality Officer a detailed plan for protecting the security of Data in the SDAF (including all microdata and data files that are used as part of these Data), protecting the security of these Data when transferring/delivering confidential Data, protecting the confidentiality of the survey respondents, protecting the privacy of survey respondents among staff, protecting against disclosure of personally identifiable information (PII) for survey respondents, and documenting any other confidentiality and access issues for the Data.

This deliverable detailed plan will be called the Confidentiality Plan and Data Security Procedures (CPDSP) and must be submitted to the COR within one (1) month of contract award. The contractor must make responsive changes to the CPDSP and submit to the COR for approval within two weeks of receiving feedback on the CPDSP. The CPDSP should include :

• The security of the facility that will house the Data (including all microdata and data files that are used as part of these Data);

• The physical and environmental protections of the rooms in which the Data will be stored;

• Access control of the facility in which the Data are housed;

1 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf 2 https://csrc.nist.gov/publications/detail/fips/200/final https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://csrc.nist.gov/publications/detail/fips/200/final

• Standards that address the physical and environmental protections for individuals who will access the Data remotely;

• Protections for the network on which the Data are housed;

• Authorization and access controls for the network on which the Data are housed;

• Network password requirements to access the network on which the Data are housed;

• Data use agreements;

• Data disclosure procedures and review;

The CPDSP must also include details on continuity plans, including a Contingency Plan (CP), a Disaster Recovery Plan (DRP), and a Continuity of Operations Plan (COOP) as described in Task 2.3.2.5. The contractor must update the CPDSP to reflect any changes in the NSF’s and OMB’s policies during the period of the contract. If necessary, the CPDSP can be modified at the discretion of and with approval from NCSES.

2.3.2.2 Physical Protection

Upon approval of the CPDSP by NCSES Chief Statistician, the contractor must implement procedures addressed in the CPDSP that protect the privacy of survey respondents for Data in the SDAF and protect against disclosure of individually identifiable information to unauthorized individuals. The contractor must strictly control access to individually identifiable information and ensure that only authorized personnel with a need to know will have access to such individually identifiable data.

The contractor must observe secure database maintenance practices and strict version control procedures and both these procedures should be documented in the CPDSP. The contractor must also document any new confidentiality and access issues that may arise that are not addressed in the CPDSP for the SDAF.

The contractor must propose procedures for data protection and dissemination to address these issues and provide an updated CPDSP no later than one month after new issues are identified for approval by the NCSES Chief Statistician. NCSES has the right to conduct unannounced, unscheduled inspections of the Contractor’s site to assess compliance with the CPDSP.

2.3.2.3 Data Use Agreements

The Contractor must document and implement procedures to ensure that all Data under this contract will be protected from unlawful disclosure and that the Data will only be used for statistical purposes. The contractor must make all staff working with individually identifiable data aware of the importance and requirements for maintaining confidentiality. A duly authorized representative of the Contractor’s organization with legal authority to bind the organization must sign the Organization Data Use Agreement (see Attachment C). ALL contractor staff (including any subcontractors) working on the Data must sign an NCSES Individual Data Use Agreement and Affidavit of Nondisclosure (see Attachments A and B) each year, acknowledging their responsibilities to protect the Data.

In addition, contractor staff using NCSES data will also be required annually to take NCSES-mandated training about data confidentiality. This training will be made available via the Internet or other media as approved by the NCSES Chief Statistician and the NCSES Confidentiality Officer.

The signed Data Use Agreement forms, certificates of completion for the confidentiality training, and the list of all signees must be delivered to NCSES within one month of award, and annually thereafter.

Before the Contractor receives any of the Data, these steps must be completed: 1) the CPDSP must be approved by NCSES, 2) the signed NCSES Data Use Agreements for Organizations and all individuals on the project must be received by the COR, and 3) staff must complete confidentiality training.

The Contractor must provide evidence that they have approval from their Institutional Review Board (IRB) or other legal authorities from their organization to conduct activities related to the use of these Data (i.e., they adhere to the requirements of their organization) before any actual Data can be provided to the Contractor. If the Contractor does not have an IRB, they must certify that they are following NSF’s Common Rule for the Protection of Human Subjects). 3

2.3.2.4 Data Disclosure Procedures and Review

The contractor must develop and submit an annual nondisclosure statement to the NCSES Chief Statistician for approval, documenting that all required staff have signed Data Use Agreements and attended confidentiality training and identifying all incidents of the disclosure of confidential Data. The COR will provide an example of a nondisclosure statement to the contractor for guidance. In addition, as part of its CPDSP, the Contractor must have an incident response plan (see OMB M-17-12, pp. 11-13) and further the contractor must notify the COR and the NCSES Chief Statistician in writing (electronic transmission is acceptable) within 1 hour of discovery of any unauthorized release of data with individually identifiable data to anyone other than persons who have signed NCSES Data Use Agreements. The contractor must submit a nondisclosure statement and statement of actual disclosures (should any occur) of Data to the Contracting Officer (CO), COR, and the NCSES Chief Statistician each December 30th during the contract period of performance and at the end of this contract.

2.3.2.5 Computer Processing and Security

All tasks requiring computer processing work must be conducted at the contractor's secure computer facility. The contractor must implement procedures to back up the Data on a regular basis and have a process for fast, secure recovery of archived Data to be approved by the COR. NCSES data cannot be loaded onto a laptop computer or other removable device such as a thumb drive.

The contractor must maintain the SDAF data system servers in accordance with NSF's Implementation Policy for the Government Information Security Reform Act (Attachment D). This policy intends to ensure the integrity, confidentiality, authenticity, and non-repudiation of information and information systems supporting NCSES. The contractor must assist in the preparation of SDAF continuity plans as required by NSF and NCSES. These plans may include a Contingency Plan (CP), a Disaster Recovery Plan (DRP), and a Continuity of Operations Plan (COOP). The CP focuses on system or component disruptions, the DRP focuses on overall NSF disruptions, and the COOP focuses on maintaining business operations in the event of a catastrophic event. All of these plans must be documented as part of the CPDSP (see Task 2.3.2.1).

The contractor must follow the Federal Standards for Security (FIPS 140-2) (see Attachment E). Evidence of meeting this federal standard must also be documented in the CPDSP.

Because the SDAF will reside on the contractor’s servers, the contractor may have additional requirements of users, such as terms of use. The contractor must submit to the COR for approval within one month of

3 https://www.nsf.gov/bfa/dias/policy/docs/45cfr690.pdf https://www.nsf.gov/bfa/dias/policy/docs/45cfr690.pdf contract award any additional terms of use. The contractor must not impose any additional terms of use on data users prior without obtaining approval of the CO and COR.

2.3.2.6 Survey Cycle Data Release

With approval from NCSES, the Contractor may receive access to Data for a new survey cycle that has not been publicly released. No release of any Data in any form for a new survey cycle is permitted until the COR issues an official release authorization to the Contractor. The Contractor must specify in the CPDSP and implement internal written procedures and policies to ensure that Data are not released before the official NCSES release date. Violation of this contract requirement is grounds for termination of the contract.

Even after Data for a survey cycle are approved for release by the COR, there are still limitations on the access to and use of the Data. The Contractor must follow the CPDSP as approved by NCSES. The Data are covered under a combination of the Privacy Act, NSF Act, and CIPSEA. As the manager for this system of records under the Privacy Act, the Director of NCSES is responsible for controlling access to the Data.

2.3.2.7 Maintain current versions of data for the SDAF

NCSES will provide current and complete versions of the SED, DRF, SDR, NSCG, NSRCG, EDCS, and SESTAT data files, documentation, and supplementary analysis files. The COR will provide additional files for these surveys when they are available. The DRF file is updated annually. The SDR and NSCG are updated biennially. The NSRCG, ECDS, and SESTAT have been discontinued, but should be stored and maintained within the SDAF. The COR may provide additional files for other surveys to be included in the SDAF during the period of performance. For proposal preparation purposes, the contractor may assume data from three additional surveys will be added.

2.3.2.8 Create an SDAF for housing and remote access for restricted-use NCSES data and additional Federal agency data

The contractor must create an SDAF which will provide controlled access to confidential microdata to licensed users (“licensees”). The contractor must propose a method and relevant technology by which licensees will access the SDAF and submit it to the COR, the NCSES Chief Statistician, and the NCSES Confidentiality Officer for review and approval within 1 month of contract award.

The contractor must propose a method to also provide controlled access to additional restricted-use data including, but not limited to, data from other Federal agencies and submit it to the COR, the NCSES Chief Statistician, and the NCSES Confidentiality Officer for review and approval within 1 month of contract award.

The contractor will provide access to NCSES data and other confidential data (including, but not limited to, data from other Federal agencies) within the SDAF as a service to licensees for a fixed period with the possibility of licensee renewal conditional on the data owner’s approval. The contractor support will include the following services:

• Account Administration

• System Usage

• Base Software Licensing and Licensing for Additional Software

• Use of Access Endpoint Hardware (if necessary)

• Technical Support and Disclosure Review

The offeror must include a price proposal for one licensee, and the marginal cost for additional users on the same license. The cost proposal must include all hardware, software and technical support and documentation costs. Access to the SDAF will be controlled by account IDs and passwords which meet NSF and NCSES standards. The SDAF may be created to house Data or may be an existing SDAF to which the capability to house Data is added.

The contractor must develop training materials for use of the SDAF and submit them to the COR for approval no later than one month prior to initial access by approved licensees. The contractor must make responsive changes to the training materials and submit to the COR for approval within two weeks of receipt of feedback.

The contractor must include within the SDAF a separate application for disclosure protection. This application must allow researchers to deposit items for review and allow the COR and other authorized NCSES staff access to review. Upon COR approval of submitted materials, the contractor must release the materials to the researcher. The requirements for disclosure protection are provided in section 2.3.2.10.

The contractor must create an area within the SDAF for a collaborative portal (a blog or other technology internal to the SDAF that allows all licensed users to communicate among themselves and with designated NCSES staff) to highlight the work of SDAF licensees and to showcase progress (papers published, presentations, etc.) resulting from NCSES licensees accessing data in the SDAF who are willing to post their research.

2.3.2.9 SDAF Software

The facility will provide for each licensee: 2 gigabytes of storage space; 10 hours of technical support;

software, and any necessary hardware. The Contractor must make available to the licensees a complete suite of the most commonly used software (e.g., for word processing, spreadsheets, charting, presentations, statistical analysis (SPSS, SAS, R, SUDAAN)) for the analysis of the data and the writing up of results through the SDAF. In order to minimize the amount of raw output provided by the licensee to NCSES for review, and to maximize the presentation of final documents (in the form of presentations or journal articles), the SDAF must provide licensees with software that is reasonably needed to produce such final documents. Additional software (Tableau, Spark) may be needed as directed by the government.

Storage space provided for a specific license at the SDAF must be accessible to all users on the particular license even if the users are at different institutions. The SDAF will provide private work areas for each user under an individual license to share work and shared work areas for users and/or user groups across multiple licenses. The contractor must accommodate licensee requests for programs or documents from outside of the SDAF and place them within the individual’s workspace. The contractor must ensure the ability to securely partition project spaces to restrict access to groups of datasets by an approved set of users. The contractor must implement security controls to prevent insertion and removal of data and output from the environment by licensees without permission from designated individuals or data owners. Insertion of external data into project environments will be possible with the permission of government-designated individuals and update procedures for the requests for the future addition of non- NCSES data. The contractor must provide appropriate training for licensees on how to use the SDAF

2.3.2.10 SDAF User Capacity

The contractor must ensure the SDAF be initially designed to handle up to 750 users (not simultaneously).

The COR may request the contractor to expand the SDAF to accommodate additional users (see Assumptions at the end of the statement of work).

2.3.2.11 Develop on-line application for requesting, adding, and maintaining access to data in the SDAF

Access to data in the SDAF requires a data license. The contractor must develop an on-line application for researchers to submit license applications for access to and provisioning data in the SDAF. The application should be modeled after the current data owner’s procedures. The COR may require the contractor to develop specifications for the application. At a minimum, NCSES expects it to include:

• Access to the requirements for obtaining a license (except for the security plan, requirements for which will depend on the technology used for access to the SDAF)

• Ability to submit a data requirements and a research plan for the researcher’s project

• Ability for licensees from different institutions to indicate that they would like a shared space for collaboration

• Ability for licensees to update their licenses (e.g. to request access to additional data, to add collaborating researchers, or to extend their license period)

• Ability to maintain a listing of all the proposed users on the license

• Access to the actual license document and forms for the licensee to download that the institution must send NSF after the analysis plan is approved and before researchers can access data in the

SDAF.

• Ability for the COR and other authorized NCSES staff to access the submitted materials for review and approval.

• Upon approval by NCSES and the sponsoring agency, ability for the researcher to download the legal agreement for the appropriate signatures at the research institution and at NCSES.

The contractor must follow best practices for presentation of online forms in developing the application.

The contractor must conduct usability tests of the application for ease of use and submit a report of the testing findings to the COR for review and approval. The COR will test and approve the application module. In addition, the COR will draft the information collection request (ICR) package obtain OMB clearance for the collection of information through the application module. The contractor will review and provide feedback to NCSES on the ICR before NCSES submits the package to OMB. Upon OMB approval, the contractor must make the application module available to users.

The contractor must not give any user access to any data files until the license process is completed and the license is approved by the data owner.

In order to maintain the license, users must provide periodic feedback. The licensing application should allow for the following:

• An approval process to add new users to a license, or to remove existing users.

• Tracking of initial confidentiality training, updates, provisioned data sets and storage of documentation.

The COR may require the contractor to update this licensing application if there are any changes to the licensing procedures required by the data owner.

2.3.2.12 Disclosure review of documents produced by licensees using data within the SDAF

The contractor must conduct a review of all products and apply appropriate disclosure protection techniques. The COR will provide the appropriate technique(s) and parameters to protect the master data sets deposited in the SDAF under standard protocols and conditions. The contractor, in collaboration with the COR and working from current data owner guidance and in alignment with the CPDSP, will develop detailed disclosure avoidance specifications and submit them for approval to the COR within one month of receiving the techniques from the COR. The contractor must review tabulations that fall within standard protocols, the contractor must approve or reject the request and provide the reason for the actions within 1 business day or less of the submission. The contractor must maintain a record of all submissions and submit to the COR on a monthly basis.

The contractor must send any tabulations, analysis, or other research work that falls outside the standard protocols to the COR. The COR may request the contractor to provide recommendations for additional techniques for disclosure protection.

The contractor must maintain a running inventory of special situations and use it to suggest and develop improved disclosure specifications.

2.3.2.13 Documentation of the SDAF

The contractor must prepare and maintain separate technical documentation of the SDAF. This documentation must include technical specifications, information on the system architecture and any other information that will be required to facilitate the objectives of this project. Final documentation must be delivered to the COR for review one year prior to the end of the contract.

2.3.2.14 Transition to Secure Compute Environment

To ensure a smooth transition of the project to the Secure Compute environment, the contractor must develop and implement a phased transition plan to transform the SDAF into to the Secure Compute Environment, adding additional functionality and requirements no later than August 1, 2026, to ensure uninterrupted service of the prior SCE contract. The contractor must submit the transition plan to the COR for review one month after award. The COR will provide comments and the contractor will make responsive changes to the transition plan and resubmit to the COR for approval within two weeks of receipt of feedback.

2.3.3.1 Secure Compute Environment – Core Infrastructure

The Contractor will accomplish the following activities at a minimum to transition the SDAF into the Secure Compute Environment.

• Transition the SDAF into a secure, scalable, transferable, cloud based (FedRAMP Moderate Impact Level) compute environment (housed on U.S. servers only) in which data can be linked and utilized for statistical purposes.

o The contractor must leverage existing FedRAMP Authorized cloud service(s) at the Moderate Impact Level.

o The contractor must confirm implementation of controls contained within the FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements for moderate impact systems (as defined in FIPS PUB 199).

o The contractor must create, maintain, and update the following documentation using FedRAMP requirements and templates (https://www.fedramp.gov/) to support the agency Authority to Operate (ATO) process:

Privacy Impact Assessment (PIA) FedRAMP Test Procedures and Results Security Assessment Report (SAR) System Security Plan (SSP) IT System Contingency Plan (CP) IT System Contingency Plan (CP) Test Results Plan of Action and Milestones (POA&M) Continuous Monitoring Plan (CMP) FedRAMP Control Tailoring Workbook Control Implementation Summary Table Results of Penetration Testing Software Code Review Interconnection Agreements/Service Level Agreements/Memorandum of

Agreements o Develop and maintain FedRAMP documentation for an Authorization package (See the Excel sheet for FedRAMP-Initial-Authorization-Package-Checklist.xlsx (live.com).

o The following individuals will fulfill the following roles for ATO:

Authorizing Official

• NCSES Director Information System Security Officer (ISSO)

• Deputy Chief Information Security Officer, NSF System Owner

• Data Access, Confidentiality, and Quality Assessment (DACQA) Program Director, NCSES o Select a Third-Party assessment Organization (3PAO) to conduct independent assessment of controls in place for the ATO and annually thereafter (required by FedRAMP).

https://www.fedramp.gov/ https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.fedramp.gov%2Fassets%2Fresources%2Ftemplates%2FFedRAMP-Initial-Authorization-Package-Checklist.xlsx&wdOrigin=BROWSELINK o Following the ATO, maintain continuous monitoring and produce documentation for 3PAO and Federal review (scanning results, POA&M, annual assessments, etc.). See the CSP Authorization Playbook - Vol. I & II (fedramp.gov) for a full description of service provider and Federal staff responsibilities during the authorization process.

o Complete the ATO process no later than one year after award, pending government delays.

• Provide for archiving of project spaces for a time period specified by NCSES, but not to exceed the period of performance of this contract. Transfer of archived project spaces must be included in the transition plan.

• Allow for the ability to further add or remove functionality based on future needs and funding.

Any future additions or removals would require a contract modification.

2.3.3.2 Secure Compute Environment – Privacy Enhancing Technology (Optional Task) The Contractor will accomplish the following activities to implement Privacy Enhancing Technology to the SCE, subject to the continued support and funding of the NSDS.

• Maintain a Privacy Preserving Record Linkage (PPRL) infrastructure, including options for multiple PPRL tools, incorporating staff expertise and other resources to ensure support for

PPRL

• Support platforms to deploy secure multi-party computing and fully homomorphic encryption solutions

• Support access to validation servers that execute statistical programs developed and debugged on synthetic data to run on the confidential data, with disclosure protections added to estimates to preserve privacy, potentially including noise.

2.3.3.3 Secure Compute Environment – High Performance Computing (Optional Task) The Contractor will accomplish the following activities to implement high performance computing to the SCE, subject to the continued support and funding of the NSDS.

• Ensure a super compute capacity to manipulate large datasets with records of 100M+ and 1000+ unique columns or variables.

2.3.4 Secure Compute Environment and Secure Data Access Facility Support In addition to creating the environment, we require the offeror to maintain the environment and SDAF and provide customer support in establishing project spaces and supporting user access, user training, and “helpdesk” support. The contractor must propose training activities that support users in accessing and utilizing the SCE functions.

2.3.5 System Support tasks

2.3.5.1 System Administration

The Contractor will, at a minimum, conduct the following activities to support both the Secure Data Access Facility and Secure Compute Environment:

• Deploy system buildout/setup/updates, configuration changes, and patches.

https://www.fedramp.gov/assets/resources/documents/CSP_Authorization_Playbook_Getting_Started_with_FedRAMP.pdf

• Maintain latest version/security patches on all software to be updated at least once a month.

• Support validation activities (testing/approving).

• Provide logging of user actions and production of audit logs to monitor suspicious behavior and security threats.

• Monitor system status and security scan results and respond as needed.

• Offerors should propose an approach that maximizes up time, including having a back-up system administrator.

• Scale up to accommodate up to 2000 users from the 750 users of the SDAF, providing a fixed price for annual seat licenses at the user level. Surge capacity beyond 2000 users should be available, if needed.

2.3.6 Section 508 of Rehabilitation Act and general accessibility Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-

220) requires that when federal agencies develop, procure, maintain, or use information and communication technology (ICT), it will be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities.

Products, platforms and services delivered as part of this performance work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps.

A, C & D, and available at https://www.access- board.gov/guidelines-and-standards/communications-and-it/about-the-ict- refresh/final-rule/text-of-the-standards-and-guidelines.

2.4 Places of performance and work conditions/hours

The place of performance and work conditions and hours are to be determined by the Contractor. No work will be performed outside the United States, including accessing government data and email. Any government-provided equipment cannot be taken outside of the United States. The award will be for five (5) years, with a year base and four one(1)-year options.

2.5 Transition activities

To ensure the smooth transition-out of the project to a potential new contractor at the end of this contract, the contractor will develop and execute a COR approved transition-out plan for the project to a new contractor. This plan will be delivered 6 months before the expected end of the contract.

2.6 Technical Evaluation

2.6.1 Key Personnel

Key personnel to be included for this project must include:

• Project manager (PM) o Preferred Qualifications

5+ years of project management experience in IT/security projects PMP or equivalent certification Proven track record of managing secure system implementation https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

Strong understanding of data security and compliance

• Business Analyst (product owner) o Preferred Qualifications 3+ years of experience in business analysis or product ownership Familiarity with data protection regulations and secure system design Strong communication skills to bridge technical and business domains.

• Systems Developer – Team Lead o Preferred Qualifications

3+ years of experience in secure systems development Proficiency in secure coding practices and secure development frameworks Familiarity with data encryption, secure storage, and access control models

• Additional Task Leads (as proposed)

Offerors must identify and describe the capabilities and experience of key personnel and organizations as these elements relate to the proposed project. Descriptions of experience should serve to demonstrate the key personnel’s ability to successfully conduct the proposed research or project, including access to critical resources for the project. Designate any supervisory relationships and who will be the main point of contact for regular check-ins with the NCSES team during the project. Provide condensed resumes (2-page maximum) for all key personnel on the project. Resumes must be organized in an appendix to the proposal. Resumes do not count toward the 15-page limit for the proposal.

Describe any unique capabilities that the offeror team possesses that may reduce project risk, reduce project duration, and/or improve project financial performance.

2.6.2 Past Performance

The contractor shall demonstrate a proven track record in designing, developing, and deploying secure data systems in environments with strict regulatory and compliance requirements. Prior experience must include successful delivery of projects involving data encryption, identity and access management, secure authentication mechanisms, and role-based access control. The contractor is expected to provide at least three past performance examples of similar scope and complexity, including technologies used and compliance standards met.

2.6.3 Technical Approach

The contractor shall provide a comprehensive technical approach outlining the methodology, tools, and technologies to be used in the design, development, testing, and deployment of the SDAF and SCE. The technical approach must prioritize data protection and secure authentication while ensuring system scalability, performance, and maintainability.

2.7 Quality Control and Efficiency

The offeror will be expected to support this secure virtual data access environment for NCSES and potentially for the National Secure Data Service project through the duration of the contract.(

If there are existing tools, software, and technologies that can achieve the stated goals of the SDAF or SCE, then the offeror should use them and avoid developing custom-built tools, software, and technologies. If new tools are required, the offeror should provide a clear explanation for why existing technologies in the market are insufficient. All technology and software developed should be easily portable with minimal constraints imposed by proprietary software and have suitable Application Programming Interfaces (APIs) for plug and play.

If any information technology (IT), websites, and/or cloud technologies are procured or developed as a part of the SDAF or SCE effort, then the offeror must ensure that these solutions comply with NSF and/or federal IT security, information management, and data security requirements. Coordination with NSF’s Office of the Chief Information Officer (OCIO) may be required as well as other Offices of Security at federal agencies, as needed.

One copy of all reports will be submitted to the COR. The contractor will deliver each report in a mutually agreed upon format. Deliverables are to be transmitted with a cover letter, on the contractor’s letterhead, describing the contents.

Only the Contracting Officer’s Representative (COR) or Contracting Officer (CO) has the authority to inspect, accept, or reject all deliverables. Final acceptance of all deliverables will be provided in writing, or in electronic format, to the PM or CO within 30 days from the end of the contract.

The contractor will establish and maintain a complete Quality Control Plan (QCP) within 60 calendar days of contract award to ensure the services are performed in accordance with the Statement of Work (SOW) and commonly accepted commercial practices. Strategies for quality control should be included in the proposal submission. The contractor will develop and implement procedures to identify, prevent and ensure non-recurrence of defective services. The government reserves the right to perform inspections on services provided to the extent deemed necessary to protect the government’s interests.

The contractor must control the quality of the services and deliverables provided in support of this project and maintain substantiating evidence that services conform to contract quality requirements and furnish such information to the government if requested. The QCP will include a quality control matrix (QCM). The QCM will reflect the quality approach of the vendor as it applies to the key areas of the offeror’s proposal.

Period of Performance

Period of Performance Base - Transition 30 days Base Period 12 months Option Year 1 12 months Option Year 2 12 months Option Year 3 12 months Option Year 4 12 months

Deliverable Schedule

Deliverable Reference Section Due Date Project Roadmap 2.3.1.1 Within 1 month after award Resource Plan 2.3.1.5 With proposal submission Confidentiality Plan and Data Security Procedures (CPDSP)

2.3.2.1 Within 1 month after award

Review and Approval of CPDSP 2.3.2.1 within 2 weeks after receiving feedback

Implement CPDSP Procedures 2.3.2.2 after CPDSP is approved Data Use Agreements 2.3.2.3 1 month after award and annually after Data Disclosure Procedures and Review

2.3.2.4 December 30th of every year

and at the end of the contract

Any additional terms of use (if applicable)

2.3.2.5 within 1 month after award

Create an SDAF 2.3.2.8 within 1 month after award Develop training materials for use of the SDAF

2.3.2.8 1 month prior to initial access by approved licensees responsive changes to the training materials (if applicable)

2.3.2.8 2 weeks after receipt of feedback

Submit findings of the usability tests of the application

2.3.2.11

Make application module available to users

2.3.2.11 After OMB approval

Develop detailed disclosure avoidance specifications

2.3.2.12 within 1 month of receiving the techniques from the COR

Risk Management Plan 2.3.1.2 as agreed upon with COR Communication Plan 2.3.1.4 within 6 months after award Financial Management Plan 2.3.1.5 as agreed upon with COR Monthly Financial Reports 2.3.1.5 as agreed upon with COR Monthly Risk Reports 2.3.1.2 as agreed upon with COR Technical Documentation 2.3.1.3 as agreed upon with COR SCE Transition Plan 2.3.2.14 Within 1 month after award Transition to SCE 2.3.2.14 8/1/2026 Privacy Impact Assessment (PIA) 2.3.3.1 as agreed upon with COR FedRAMP Test Procedures and Results

2.3.3.1 as agreed upon with COR

Leverage existing FedRAMP Authorized cloud service(s) at the Moderate Impact Level

2.3.3.1 as agreed upon with COR

Confirm implementation of controls

2.3.3.1 as agreed upon with COR

Complete Authority to Operate (ATO) process

2.3.3.1 12 months after award

Security Assessment Report

(SAR)

2.3.3.1 as agreed upon with COR

System Security Plan (SSP) 2.3.3.1 as agreed upon with COR

IT System Contingency Plan (CP) 2.3.3.1 as agreed upon with COR IT System Contingency Plan (CP) Test Results

2.3.3.1 as agreed upon with COR

Plan of Action and Milestones

(POA&M)

2.3.3.1 as agreed upon with COR

Continuous Monitoring Plan

(CMP)

2.3.3.1 as agreed upon with COR

FedRAMP Control Tailoring Workbook

2.3.3.1 as agreed upon with COR

Control Implementation Summary Table

2.3.3.1 as agreed upon with COR

Results of Penetration Testing 2.3.3.1 as agreed upon with COR Software Code Review 2.3.3.1 as agreed upon with COR Interconnection Agreements/Service Level Agreements/Memorandum of Agreements

2.3.3.1 as agreed upon with COR

Implement Privacy Enhancing Technology

2.3.3.2 as agreed upon with COR

Implement high performance computing

2.3.3.3 as agreed upon with COR

Prepare and maintain separate technical documentation of the

SDAF

2.3.2.13 12 months prior to contract end

Transition-Out Plan 2.3.1.6 6 months prior to contract end Quality Control Plan 2.7 With proposal submission

Contract Line Items and Contract Type CLIN 0001 (Firm Fixed Price) 2.3.1 Project Management

CLIN 0002 (Firm Fixed Price) 2.3.2.1 Secure Data Access Facility

CLIN 0003 (Firm Fixed Price) 2.3.2.2 Secure Compute environment – Core Infrastructure

CLIN 0004 (Firm Fixed Price - Optional) 2.3.2.3 Secure Compute environment– High Performance Computing

CLIN 0005 (Firm Fixed Price - Optional) 2.3.2.4 Secure Compute environment–Privacy Enhancing Technology

CLIN 0006 (Time & Materials) 2.3.2.5 Secure Compute environment–Software

CLIN 0007 (Time & Materials) 2.3.3.1 Secure Data Access Facility and Secure Compute Environment Capacity

CLIN 0008 (Firm Fixed Price) 2.3.3.2 Secure Data Access Facility and Secure Compute environment Support

CLIN 0009 (Other Direct Costs – Optional) – Not-to-Exceed $500,000

An option CLIN for surge is intended to be included in the task order for unanticipated increases in users and user support. The CLIN would be priced based on the size of team, or ramp-up of current team to accommodate such workload. Pricing for small, medium, and large teams or equivalent ramp-up should be provided. The Option CLIN would be included in the award based on the pricing submitted with a Not-to-Exceed value that could be exercised in the event the need exists and the funds become available.