Attachment_A-_Main_PWS_7-14-14_rev1.pdf

Next Generation Professional Learning Portal, Content Integration and Technical Assistance

Attachment A: Master Performance Work

Statement

ABSTRACT

Contractor support services to perform the operations, sustainment, documentation, training, and enhancement of the Next Generation

Professional Learning Portal, Content Integration and

Technical Assistance Contract.

August 2014

ED-ESE-14-R-0030 Attachment A- Master PWS

Table of Contents Background

Purpose and Scope

Objectives and Tasks

Task 1 – Contract/Project Administration

Task 2 - Technical Assistance (Content Delivery)

Task 3 - Content Creation and Integration

Task 4 - Stakeholder Collaboration

Task 5 - Subject Matter Experts (SMEs)

Task 6 - Y4Y Enhancements and Professional and/or Educational “Credit for Completion”

Task 7 - Operations & Maintenance

Background The Department of Education’s (the Department) mission is to ensure equal access to education and to promote educational excellence throughout the nation. The Office of Elementary and Secondary Education (OESE) Office of Academic Improvement Teacher Quality (AITQ) is responsible for administering the 21st Century Community Learning Centers (21st CCLC) program, which is among the many grant programs that support the mission of the Department. Implementation of the Next Generation Professional Learning Portal is directly relevant to the Department’s Strategic Plan in Goal 1, Improve Student Achievement:

“The Department of Education's mission is to promote student achievement and preparation for global competitiveness by fostering educational excellence and ensuring equal access.”

The 21st CCLC program is a State formula-grant program authorized under Title IV, Part B, of the Elementary and Secondary Education Act, as amended by the No Child Left Behind Act of 2001. The No Child Left Behind Act converted the 21st CCLC program from discretionary grants made directly by ED, to a program in which each State receives a grant based on its share of ESEA Title I, Part A funds. States must use their allocations to make competitive awards to eligible entities. The Secretary may reserve up to one percent of the total appropriation for the 21st CCLC program to carry out an array of national activities, including (but not limited to) national evaluations and the technical assistance activities described in this performance work statement (PWS).

The goal of the 21st CCLC program is to enable eligible entities serving high needs communities to plan, implement, or expand academic enrichment opportunities supporting out-of-school time and expanded learning time (ELT)1. The program helps students meet state and local student standards in core

For purposes of flexibility under the ESEA, ELT is the time that a local educational agency (LEA) or school “extends its normal school day, week, or year to provide additional instruction or educational programs for all students beyond the State-mandated requirements for the minimum number of hours in a school day, days in a school week, or days or weeks in a school year.”

academic subjects, such as reading and math; offers students a broad array of enrichment activities that can complement their regular academic programs; and offers literacy and other educational services to the families of participating children.

Purpose and Scope The Department maintains a professional learning web portal- You For Youth (Y4Y) (website (www.y4y.ed.gov) – to meet the national and local training needs for the 21st CCLC grant community.

This PWS reflects an Indefinite Delivery/Indefinite Quantity (IDIQ) The scope of the PWS encompasses Contractor support services to perform the operations, sustainment, documentation, training, and enhancement of the Next Generation Professional Learning Portal, Content Integration and Technical Assistance Contract.

While the portal focuses on improving the quality of 21st CCLC programs, the target audience includes, not only 21st CCLC grantees and sub-grantees, but also non-Federal after-school programs, family engagement programs, full-service community schools and providers, and other entities that provide programs and/or services that focus on student achievement. Further, the training and professional learning that will be designed through this project will include opportunities that will engage stakeholders from a broad perspective: community- and faith-based organization; full-service community schools, local government entities, private educational institutions, etc.

This project will build upon the work done under previous Department-funded contracts. The Contractor shall have the ability to support an online and in-person learning environment that addresses the needs of thousands of after-school professionals and provides professional and/or educational credit for course completion.

The Contractor shall adhere to all Federal Government, Department of Education regulations, directives and standards related to the Clinger-Cohen Act of 1996, also known as the Information Technology Management Reform Act (ITMRA), Federal Information Security Management Act (FISMA), the Government Information Security Reform Act (GISRA), the Computer Security Act of 1987, OMB Circulars A-130 and A-123, and IRM 2.1.10.

Objectives and Tasks The following overarching objectives are mandated to be accomplished under this contract.

1. Establish a partner-focused working relationship with Government.

2. Provide a partnership with team members and/or subcontractors that appears seamless to the

Government and that fosters shared accountability and responsibility among all partners.

3. Establish appropriate and effective incentives that fundamentally align the goals and objectives of the Contractor and Government to ensure superior services are provided.

4. Throughout the life of this effort, demonstrate improved performance, reliability, security, and reduced cost of operating Y4Y and providing 21st CCLC technical assistance.

5. Provide timely services to enable the 21st CCLC Program and Y4Y meet its mission critical requirements.

Task Areas

Below are the task areas for this ID/IQ contract and examples of the type of tasks that may be obtained under this PWS.

Task 1 – Contract/Project Administration

A kickoff meeting shall be conducted between the Contractor and the Government at the Department of Education headquarters in southwest Washington D.C., to discuss contract objectives and timelines for the awarded task order.

The Contractor’s project management may include detailed planning and coordination of contract activities and related technical engineering requirements to enable the efficient operations, sustainment, documentation, training, and enhancement of the Next Generation Professional Learning Portal, Content Integration and Technical Assistance Contract. The Contractor will provide project management support to promote the optimal use of Contractor resources, ensure adequate contract performance, and establish management controls in order to provide quality services within budget and on time.

Project management may consist of:

1. Management of the Contractor’s activities using industry standard project management processes to initiate, plan, execute, control, and close the project in accordance with the Guide to the Project Management Body of Knowledge (PMBOK) or other industry standards.

2. Monthly progress reports that include, at a minimum: a brief, factual summary description of operation and maintenance activity for each task (or groups of tasks) during the reporting period, work scheduled for the next reporting period, variances between work scheduled and work performed, issues, risks and proposed corrective actions. The report shall also provide performance measurement status, as required by this contract, and an extract from the risk management repository. Note that Earned Value Management (EVM) reporting is required for all enhancement activities. These enhancement activities will be detailed as separate tasks to this PWS and awarded as needed by the Government. EVM reporting requirements are also detailed in the Federal Acquisition Regulations (FAR) subpart 34.2.

3. The development of a Project Management Plan of processes and procedures that demonstrate management controls are in place, used, and quality control is conducted.

The Contractor shall deliver the Project Management Plan to the COR for review and approval.

4. The development and maintenance of an Integrated Project Schedule.

5. The development of an electronic project library.

6. The development of a Project Effectiveness Plan and an Annual Report

Task 2 - Technical Assistance (Content Delivery)

Utilizing all Y4Y resources, the Contractor may develop customized technical assistance to States and subgrantees. Delivery of technical assistance shall include both on-site and virtual capabilities. The contractor shall provide scalable, web-based solutions as a service (SaaS /

PaaS) to provide virtual, instructor-led, and blended technical assistance programs. Technical assistance may include:

1. Targeted On-site technical assistance.

2. Targeted Virtual technical assistance.

3. Virtual Technical Assistance

4. National, State or Regional Conference support

Task 3 - Content Creation and Integration

The Contractor may provide support in the area of content creation, content integration, and content updates. This may include:

1. Content design and development.

2. Integration of content developed by other contractors or third parties.

3. Participation in design and status meetings with third party content providers and serve as a resource to these providers in their efforts to design and develop content for Y4Y.

4. Assuming responsibility for all activities related to deployment of third party content to

Y4Y to include any transformation/integration activities.

5. Updating content in existing modules.

Task 4 - Stakeholder Collaboration

The Contractor might be required to assemble a Technical Working Group (TWG) and Listening Sessions. The TWG is designed to collaborate on education strategies, informational practices and Y4Y evaluation. The Listening Sessions will assist in determining the training needs of the portal audience, provide feedback on the methods used in the delivery of training and recommend functional changes to the Y4Y Professional Learning Portal.

This might require face-to-face or virtual meetings. If a face-to-face meeting is required, the Contractor might be responsible for coordinating and reimbursing the travel, per diem, and lodging arrangements for non-local participants in accordance with federal travel regulations.

Task 5 - Subject Matter Experts (SMEs)

The Contractor shall provide direct subject matter expertise or obtain subject matter experts to provide technical assistance in a variety of 21st CCLC related topics.

The following are examples of tasks that may be expected of the SMEs:

Conduct case studies on specific topic areas

Provide topic-specific on-site technical assistance to States and subgrantees

Conduct research and produce white papers on specific topic areas

Conduct a needs assessment

Develop logic models

Assist in content creation for professional learning modules

Organize topic-specific distance learning opportunities for target audiences

Assemble a temporary topic specific technical working group

The Contractor may be required to provide the direction and management of such experts and ensure the delivery of high quality services and/or products.

Task 6 - Y4Y Enhancements and Professional and/or Educational “Credit for Completion”

Enhancements to the Y4Y Portal are subject to EVM reporting requirements and will be provided on separate task orders to this contract. Examples of enhancements could include changes to the Y4Y user interface, additional module/content creation, additional reporting requirements, studies, analysis or white papers.

In addition the contractor may be required to develop and implement professional and/or education credit for training/course completion.

Task 7 - Operations & Maintenance

The Contractor may be required to operate and maintain the existing web portal in accordance with established practices, which might include, but not limited to:

Ensure Y4Y remains fully functional and stable (e.g. bug-fixes, security upgrades, software patches), and complete all required system, hardware and software upgrades in a timely manner. Note: all upgrades or enhancements shall be coordinated with ED.

Interface daily with customers and other Y4Y personnel to maintain a high quality of support for Y4Y. Responsibilities shall include system usage training for the customers, and rapid response to all technical problems reported to the Contractor by the customers or by Y4Y staff.

Be expected to install and maintain all Y4Y hardware components and keep track of them via an automated reporting and tracking tool.

In addition, the Contractor may be required to provide a full range of Asset Management Support including, but not limited to:

Shipment of Automated Data Processing (ADP) assets, including coordination with shipping and receiving departments to ship and track inventory assets;

Receipt of ADP assets including moving, unpacking, ensuring distribution and testing, and completing all required documentation;

Perform installation and troubleshooting of hardware as needed;

Dispose of aging equipment ensuring that all information has been wiped/erased in accordance with applicable security regulations;

Work with manufacturers in connection with upgrades and repairs of equipment, memory, processor upgrades, Operating Systems (OS) issues, all hardware replacements and registration of those assets; and

Providing a report listing updates to existing assets every six months

Compliance with ED IT Security Policy The contractor, and all sub-contractors, shall comply with the Department of Education’s IT security policy requirements, specifically those set forth in the ‘Handbook for Information Assurance Security Policy (OCIO-01)’, and other applicable procedures and guidance. The contractor, and all sub-contractors, shall develop and implement management, operational and technical security controls to assure required levels of protection for information systems. The contractor, and all sub-contractors, shall further comply with all applicable Federal IT security requirements including, but not limited to, the Federal Information Security Management Act (FISMA) of 2002, Office of Management and Budget (OMB) Circular A-130 Appendix III, Homeland Security Presidential Directives (HSPD), the National Institute of Standards and Technology (NIST) standards and guidance, and the Federal Risk and Authorization Management Program (FedRAMP) requirements and guidance.

These security requirements include, but are not limited to, the successful Security Authorization (SA) of the system (includes commercially owned and operated systems managed by the commercial vendor and its sub-contractors, supporting Department programs, contracts, and projects); obtaining a full Authority to Operate (ATO) before being granted operational status; performance of annual self-assessments of security controls; annual Contingency Plan testing; performance of periodic vulnerability scans; updating all information system security documentation as changes occur; and other continuous monitoring activities, which may include, mapping, penetration and other intrusive scanning. Full and unfettered access for the Department’s third party Managed Security Services Provider (MSSP) must be granted to access all computers and networks used for this system. Additionally, when there is a significant change to the system’s security posture, the system (Federal and commercial prime- and sub-contractors included) must have a new SA, with all required activities to obtain a new ATO, signed by the Authorizing Official (AO).

System security controls shall be designed and implemented consistent with NIST SP 800-53 Rev 4, ‘Recommended Security Controls for Federal Information Systems and Organizations.’ All NIST SP 800-53 controls must be tested / assessed no less than every 3 years, according to federal and Department policy. The risk impact level of the system will be determined via the completion of the Department's inventory form and shall meet the accurate depiction of security categorization as outlined in Federal Information Publishing Standards (FIPS) 199, ‘Standards for Security Categorization of Federal Information and Information Systems.’

System security documentation shall be developed to record and support the implementation of the security controls for the system. This documentation shall be maintained for the life of the system. The contractor, and all sub-contractors, shall review and update the system security documentation at least annually and after significant changes to the system, to ensure the relevance and accurate depiction of the implemented system controls and to reflect changes to the system and its environment of operation. Security documentation must be developed in accordance with the NIST 800 series and Department of Education policy and guidance. System security documentation may include but is not limited to:

Risk Management Plan

IT Contingency and Disaster Recovery Plan

Configuration Management Plan and Repository

Change Management Plan

Requirements Management Plan

Functional Requirements Document

System Design Document

NIST Self-Assessment (Annually)

Remediation Plan (Plan of Actions and Milestones Submissions)

System Security Plan

Department of Education Data Sensitivity

Incident Response Plan

Security Controls Assessment Plan

System Characterization Document

System Disposal Plan

The contractor, and all sub-contractors, shall allow Department employees (or Department designated third party contractors) access to the hosting facility to conduct SA activities to include control reviews in accordance with NIST SP 800-53, Rev. 4 and NIST SP 800-53A. The contractor, and all sub-contractors, shall be available for interviews and demonstrations of security control compliance to support the SA process and continuous monitoring of system security. In addition, if the system is rated as ‘Moderate’ or ‘High’ for FIPS 199 risk impact, vulnerability scanning and penetration testing shall be performed on the hosting facility and application as part of the SA process. Appropriate access agreements will be reviewed and signed before any scanning or testing occurs.

Identified deficiencies between required NIST SP 800-53 Rev. 4 controls and the contractor’s, and all sub-contractor’s implementation, as documented in the Risk Assessment Report, System Security Plan (SSP) and Security Assessment Report (SAR), shall be tracked for mitigation through the development of a Plan of Action and Milestones (POA&M) in accordance with the ‘Handbook for Information Assurance Security Policy (OCIO-01).’ Depending on the severity of the deficiencies, the Department may require remediation before an ATO is issued.

All awarded contracts shall ensure that:

Their IT product/system is monitored during all hours of operations using entrusted detective/preventive systems;

Their IT product/system has current antiviral products installed and operational;

Their IT product/system is scanned on a reoccurring basis;

Vulnerabilities are remediated in a timely manner on their IT product/system; and

Access/view for cybersecurity situational awareness on their IT product/system is made available to the Department CIRC (cyber incident response capability).

Internet Protocol version 6 (IPv6) For IPv6, the contractor shall provide Commercial off-the-shelf (COTS) solutions that are IPv6 capable. An IPv6 capable system or product shall be capable of receiving, processing, transmitting and forwarding IPv6 packets and/or interfacing with other systems and protocols in a manner similar to that of IPv4. Specific criteria to be deemed IPv6 capable are:

An IPv6 capable system that meets the IPv6 base requirements defined by the USGv6 Profile (http://www.antd.nist.gov/usgv6/profile.html).

http://www.antd.nist.gov/usgv6/profile.html

Systems being developed, procured or acquired shall maintain interoperability with IPv4 systems/capabilities.

Systems shall implement IPv4/IPv6 dual-stack and shall also be built to determine which protocol layer to use depending on the destination host it is attempting to communicate with or establish a socket with. If either protocol is possible, systems shall employ IPv6.

The contractor shall provide IPv6 technical support for system development, implementation and management.

Reporting of Data Security Breaches If there is a suspected or known breach/disclosure of PII due to lost, theft, intercepted transfer, or other, the contractor must ensure that this breach is reported to the agency as soon as the contractor has knowledge of it. Per Office of Management and Budget Memorandum M-06-19, Federal agencies have a requirement to report breaches of PII security to a Federal incident response center. OESE must notify the department within 30 minutes of discovering the incident (and the agency should not distinguish between suspected or confirmed breaches). The data security plan must be written to reflect this requirement, and the contractor must provide sufficient notification and documentation of the suspected loss, as it is understood at the time of notification to the agency for this requirement to be met. Follow-up reports of the final status of loss events will also be prepared by the contractor within a reasonable period of time as advised by the OESE COR.

Compliance with Section 508 of the Rehabilitation Act In 1998, Congress amended the Rehabilitation Act to require Federal agencies to make their electronic and information technology accessible to people with disabilities. Inaccessible technology interferes with an individual's ability to obtain and use information quickly and easily. Section 508 was enacted to eliminate barriers in information technology, to make available new opportunities for people with disabilities, and to encourage development of technologies that will help achieve these goals. The law applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology. Under Section 508 (29 U.S.C. 794d), agencies must give disabled employees and members of the public access to information that is comparable to the access available to others. All deliverables developed under this work statement will comply with the Section 508 of the “Americans with Disabilities Act” technical standards for web and software accessibility located at 36 CFR 1194.21 and 1194.22.