Attachment_B-_PWS_7-14-14.pdf

Next Generation Professional Learning Portal, Content Integration and Technical Assistance

Attachment B:

Performance Work Statement (Task Order 0001)

ABSTRACT

Contractor support services to perform the operations, sustainment, documentation, training, and enhancement of the Next Generation Professional Learning Portal, Content Integration and Technical Assistance Contract.

August 2014

ED-ESE-14-R-0030 Attachment B- Task Order 1 PWS

Table of Contents Background

Purpose and Scope

Objectives and Tasks

Task 1 – Contract/Project Administration

Task 1.1 - Kick-off Meeting

Task 1.2 - Phase-In and Phase-Out Periods

Task 1.3 - Project Management Support

Task 1.4 - Project Effectiveness Plan and Annual Report

Task 2 - Technical Assistance (Content Delivery)

Task 2.1 - Targeted On-site

Task 2.2 - Targeted Virtual

Task 2.3 - Quarterly Virtual Technical Assistance

Task 2.4 - National, State or Regional Conference support

Task 3 - Content Creation and Integration

Task 3.1 - Third Party Content Integration

Task 3.2 - Content Creation

Task 3.3 - Content Updates

Task 4 - Stakeholder Collaboration

Task 4.1 - Technical Working Group

Task 4.2 – Listening Sessions

Task 5 - Subject Matter Experts (SMEs)

Task 5.1 – SMEs Base Year

Task 6 - Y4Y Enhancements and Professional and/or Educational “Credit for Completion”

Task 6.1 - Professional and/or Educational “Credit for Completion”

Task 6.2 - Y4Y Enhancements (OPTIONAL)

Task 7 - Operations & Maintenance

Task 7.1 - Asset Management Support

Task 7.2 - Compliance with ED IT Security Policy

Task 7.3 - Internet Protocol version 6 (IPv6)

Task 7.4 - Reporting of Data Security Breaches

Task 7.5 - Compliance with Section 508 of the Rehabilitation Act

Background The Department of Education’s (the Department) mission is to ensure equal access to education and to promote educational excellence throughout the nation. The Office of Elementary and Secondary Education (OESE) Office of Academic Improvement Teacher Quality (AITQ) is responsible for administering the 21st Century Community Learning Centers (21st CCLC) program, which is among the many grant programs that support the mission of the Department. Implementation of the Next Generation Professional Learning Portal is directly relevant to the Department’s Strategic Plan in Goal 1, Improve Student Achievement:

“The Department of Education's mission is to promote student achievement and preparation for global competitiveness by fostering educational excellence and ensuring equal access.”

The 21st CCLC program is a State formula-grant program authorized under Title IV, Part B, of the Elementary and Secondary Education Act, as amended by the No Child Left Behind Act of 2001. The No Child Left Behind Act converted the 21st CCLC program from discretionary grants made directly by ED, to a program in which each State receives a grant based on its share of ESEA Title I, Part A funds. States must use their allocations to make competitive awards to eligible entities. The Secretary may reserve up to one percent of the total appropriation for the 21st CCLC program to carry out an array of national activities, including (but not limited to) national evaluations and the technical assistance activities described in this performance work statement (PWS).

The goal of the 21st CCLC program is to enable eligible entities serving high needs communities to plan, implement, or expand academic enrichment opportunities supporting out-of-school time and expanded learning time (ELT)1. The program helps students meet state and local student standards in core academic subjects, such as reading and math; offers students a broad array of enrichment activities that can complement their regular academic programs; and offers literacy and other educational services to the families of participating children.

Purpose and Scope The Department maintains a professional learning web portal- You For Youth (Y4Y) (website (www.y4y.ed.gov) – to meet the national and local training needs for the 21st CCLC grant community.

This PWS reflects a Firm Fixed-Price Performance-Based Acquisition (PBA) for one 12-month base year with three 12-month option years. The scope of the PWS encompasses Contractor support services to perform the operations, sustainment, documentation, training, and enhancement of the Next Generation Professional Learning Portal, Content Integration and Technical Assistance Contract.

While the portal focuses on improving the quality of 21st CCLC programs, the target audience includes, not only 21st CCLC grantees and sub-grantees, but also non-Federal after-school programs, family engagement programs, full-service community schools and providers, and other entities that provide programs and/or services that focus on student achievement. Further, the training and professional learning that will be designed through this project will include opportunities that will engage

1 For purposes of flexibility under the ESEA, ELT is the time that a local educational agency (LEA) or school “extends its normal school day, week, or year to provide additional instruction or educational programs for all students beyond the State-mandated requirements for the minimum number of hours in a school day, days in a school week, or days or weeks in a school year.”

stakeholders from a broad perspective: community- and faith-based organization; full-service community schools, local government entities, private educational institutions, etc.

This project will build upon the work done under previous Department-funded contracts. The Contractor shall have the ability to support an online and in-person learning environment that addresses the needs of thousands of after-school professionals and provides professional and/or educational credit for course completion.

The Contractor shall adhere to all Federal Government, Department of Education regulations, directives and standards related to the Clinger-Cohen Act of 1996, also known as the Information Technology Management Reform Act (ITMRA), Federal Information Security Management Act (FISMA), the Government Information Security Reform Act (GISRA), the Computer Security Act of 1987, OMB Circulars A-130 and A-123, and IRM 2.1.10.

Objectives and Tasks The following overarching objectives are mandated to be accomplished under this contract.

1. Establish a partner-focused working relationship with Government.

2. Provide a partnership with team members and/or subcontractors that appears seamless to the

Government and that fosters shared accountability and responsibility among all partners.

3. Establish appropriate and effective incentives that fundamentally align the goals and objectives of the Contractor and Government to ensure superior services are provided.

4. Throughout the life of this effort, demonstrate improved performance, reliability, security, and reduced cost of operating Y4Y and providing 21st CCLC technical assistance.

5. Provide timely services to enable the 21st CCLC Program and Y4Y meet its mission critical requirements.

Task 1 – Contract/Project Administration Task 1.1 - Kick-off Meeting Within five days of contract award, of all contract periods, the Contractor shall conduct a kickoff meeting with the Government to discuss contract objectives and timelines. The Contractor shall conduct the kickoff meeting at the Department of Education headquarters in southwest Washington, D.C. The Contractor shall provide the meeting agenda, any meeting artifacts (including the initial project plan and timeline, and subsequent meeting minutes).

Task 1.2 - Phase-In and Phase-Out Periods The Contractor shall develop comprehensive procedures for phasing in and phasing out Contractor performance to the level prescribed and within the time allowed under the terms of this contract. The Contractor's phase-in and phase-out procedures shall not disrupt or adversely impact the day-to-day conduct of Government business.

Task 1.2.1 - Phase-In (Base Year Only) During the phase-in period of the base year, the Contractor shall prepare to assume full responsibility for all areas of operation in accordance with the terms and conditions of this contract. The Contractor shall submit a Phase-In Plan to the CO for review and approval no later than 10 calendar days after contract award date. The Plan shall finalize the Contractor’s efforts to affect a smooth and orderly implementation of contract responsibility.

During the phase-in period, the Contractor shall at a minimum:

• Establish the project management office

• Recruit and hire necessary personnel

• Obtain all required certifications, licenses, permits, and clearances, including personnel security clearances if applicable

• Participate in joint inventories and sign for Government-Furnished Property

(GFP)

• Continue to develop and submit required deliverables

• Attend post-award meetings as required

• Ensure that the portal is fully operational by September 25, 2014

Deliverable(s):

• Phase-In Plan

Task 1.2.2 – Prepare and Update Phase-Out Plan A phase-out plan shall be submitted 90 calendar days prior to the completion of the base period. A revised phase-out plan shall be submitted 90 calendar days prior to the end of each option period. The purpose of the phase-out plan is to ensure that the Contractor is prepared at all times during the life of the contract to facilitate a smooth and orderly transfer of contract responsibility to a successor contractor, to the Government, or to retire the system. The COR will review the submitted phase-out plan and make requested changes as needed. The Contractor will update the phase-out plan in accordance with the COR’s requested changes.

• Phase-Out Plan

Task 1.2.3 – Execute Phase-Out Plan (OPTIONAL) If Optional Task 1.2.3 is exercised by the Government, the Contractor shall execute the phase-out. The COR will notify the Contractor whether the system is being transferred to a successor contractor, whether the system is being transferred to the Government, or whether the system is being retired.

• If the system is being transferred to a successor contractor or the Government, during this time, management personnel of the incoming workforce or Government may observe operations and performance methods of the incumbent Contractor. This will allow for the orderly turnover of equipment and records and will ensure continuity of service. The Contractor shall not defer any requirements for the purpose of avoiding responsibility or of transferring such responsibility to the succeeding Contractor or Government.

The Contractor shall fully cooperate with the successor contractor and the Government to accomplish this task.

• If the system is being retired, during this time, the system should be archived.

All digital information to include contract and system documentation, webpages, and databases and data shall be packaged and delivered to the COR.

All software licenses directly paid for by the contract shall be transferred to the Government, and the Contractor shall properly package and deliver all hardware to the Government (or dispose it), in accordance with Federal guidelines.

Task 1.3 - Project Management Support The Contractor’s project management shall include detailed planning and coordination of contract activities and related technical engineering requirements to enable the efficient operations, sustainment, documentation, training, and enhancement of the Next Generation Professional Learning Portal, Content Integration and Technical Assistance Contract. The Contractor shall provide project management support to promote the optimal use of Contractor resources, ensure adequate contract performance, and establish management controls in order to provide quality services within budget and on time.

Project management shall consist of:

1. Management of the Contractor’s activities using industry standard project management processes to initiate, plan, execute, control, and close the project in accordance with the Guide to the Project Management Body of Knowledge (PMBOK) or other industry standards.

2. Monthly progress reports that include, at a minimum: a brief, factual summary description of operation and maintenance activity for each task (or groups of tasks) during the reporting period, work scheduled for the next reporting period, variances between work scheduled and work performed, issues, risks and proposed corrective actions. The report shall also provide performance measurement status, as required by this contract, and an extract from the risk management repository. Note that Earned Value Management (EVM) reporting is required for all enhancement activities. These enhancement activities will be detailed as separate tasks to this PWS and awarded as needed by the Government. EVM reporting requirements are also detailed in the Federal Acquisition Regulations (FAR) subpart 34.2.

3. Contractor shall develop a Project Management Plan of processes and procedures that demonstrate management controls are in place, used, and quality control is conducted.

The Contractor shall deliver the Project Management Plan to the COR for review and approval no later than 10 calendar days after contract award date.

4. Contractor shall develop and maintain an Integrated Project Schedule using Microsoft Project. The Contractor shall deliver the Integrated Project Schedule to the COR for review and approval no later than 30 calendar days after contract award date.

5. The Contractor shall establish an electronic project library. As part of this library, the Contractor shall maintain, update, and create (where necessary) the following:

a. Personnel and Staffing Plan

b. Project Management Plan

c. Integrated Project Schedule

d. Monthly Progress Report

e. Personnel Roster updated semi-annually or as needed

f. Phase-in Plan

g. Phase-Out Plan

h. User manuals

i. Style guides

Additionally, the Contractor shall provide recommendations, and strategies to address the national and local training needs of the 21st CCLC program. The COR may request briefings, white papers, strategy documents, data extracts, and other reports. It is estimated that no more than five white papers and documents per year and four hours per quarter of briefings will be required.

• Project Management Plan

• Integrated Project Schedule

Task 1.4 - Project Effectiveness Plan and Annual Report Within 60 days of contract award, the Contractor shall create a Project Effectiveness Plan that identifies expected project outcomes, assesses the extent to which these outcomes are achieved; and provides evidence of improvement based on analysis of results in each of the following areas:

• Effectiveness of existing and new Y4Y content

• Effectiveness of Y4Y training and training delivery

• Effectiveness of the Y4Y Portal as a 21st CCLC resource

• Y4Y customer satisfaction

The Project Effectiveness Plan shall include both qualitative and quantitative measures.

Every six months, the Contractor shall submit a Semi-Annual Effectiveness Report. Utilizing the measures within the Project Effectiveness Plan, the Semi-Annual Report shall provide the Department with a comprehensive evaluation and analysis on the effectiveness of the activities and tasks performed under this contract. The Semi-Annual Report shall also provide recommendations for future project enhancements.

Task 2 - Technical Assistance (Content Delivery)

Utilizing all Y4Y resources, the Contractor shall develop customized technical assistance to States and subgrantees. Delivery of technical assistance shall include both on-site and virtual capabilities. The contractor shall provide scalable, web-based solutions as a service (SaaS / PaaS) to provide virtual, instructor-led, and blended technical assistance programs. Technical assistance shall consist of:

Task 2.1 - Targeted On-site Annually, the Contractor shall provide 20 targeted on-site technical assistance sessions. Each-targeted on-site session shall not be less than four hours and no more than 16 hours per visit.

Once implemented, technical assistance sessions will meet minimally determined standards to be counted as credit for completion by participants.

Task 2.2 - Targeted Virtual Annually, the Contractor shall provide 20 targeted virtual technical assistance sessions. Each virtual session shall not be less than 90 minutes or more than 180 minutes. All virtual sessions shall be recorded and made available on the Y4Y Portal and adhere to electronic records retention requirements.

Once implemented, virtual technical assistance sessions will meet minimally determined standards to be counted as credit for completion by participants.

Task 2.3 - Quarterly Virtual Technical Assistance Beginning 120 calendar days after the award date, the Contractor shall offer, not less than once per quarter, regular interactive satellite platforms for technical assistance, such as webinars, discussions forums, expert panels, etc. These will be approximately 30-60 minutes in length and address topics of interest in cooperation with the Department. All content shall be approved by the COR prior to delivery. All webinars shall be recorded and made available on the Y4Y Portal and adhere to electronic records retention requirements.

Task 2.4 - National, State or Regional Conference support The Contractor shall, make high-quality, informed presentations at conferences or meetings based on work accomplished under the tasks in this contract. Up to five such presentations are estimated per year. The Contractor may be requested to present with Department staff or alone at Department-sponsored conferences or events. The Contractor shall create presentation slides and provide all materials necessary for their presentation, such as handouts or reference materials. The Contractor shall provide the COR with copies of their final presentations no later than five business days prior to the meeting for review and approval.

Task 3 - Content Creation and Integration

Task 3.1 - Third Party Content Integration

The Contractor shall integrate content developed by other contractors or third parties.

Integration will include collecting the content and conducting extensive work to make it portal ready. The Contractor shall develop a System Integration Guide and a System Style Guide to aid third party content providers in developing and designing content that conforms to Y4Y technologies and user experience/user interface. The Contractor shall participate in design and status meetings with third party content providers and serve as a resource to these providers in their efforts to design and develop content for Y4Y. The Contractor shall be responsible for all activities related to deployment of third party content to Y4Y to include any transformation/integration activities. The Contractor shall be expected to integrate two third party content modules each contract year.

Once implemented, all integrated content will meet minimally determined standards to be counted as credit for completion by participants.

Task 3.2 - Content Creation The contractor shall design and develop one new content module for the base period adhering to the agreed-upon release schedule as outlined in the Project Management Plan and Integrated Project Schedule. For each subsequent option period, the Contractor shall design and develop two new content modules utilizing the results detailed in the Semi-Annual Effectiveness Report.

These modules should have the same format/template of the existing website in order to provide a cohesive user experience for further professional learning opportunities while also addressing changing needs and priorities. The Contractor shall consult with one - two subject-matter experts for each module, as approved by the COR. In addition, the Contractor shall provide specific details on module identification and development in the monthly reports, as referenced in the Monthly Progress Report.

Once implemented, all content will meet minimally determined standards to be counted as credit for completion by participants.

Task 3.3 - Content Updates In order that modules and content remain useful to the Y4Y audience and align with national needs and priorities, the Contractor shall update one existing content module for the base period adhering to the agreed-upon release schedule as outlined in the Project Management Plan and Integrated Project Schedule. For each subsequent option period, the Contractor shall update two existing content modules utilizing the results detailed in the Semi-Annual Effectiveness Report. Updates to existing content modules may include the addition of new and relevant content and/or new materials for user utilization to an existing learning module.

Updates may also include revision of existing content and materials to reflect new research, needs, and/or priorities.

Task 4 - Stakeholder Collaboration

Task 4.1 - Technical Working Group The Contractor shall assemble a Technical Working Group (TWG) to collaborate on education strategies, informational practices and Y4Y evaluation. Meetings occur quarterly and shall consist of the following:

• one face-to-face meeting annually in Washington, DC at an ED Facility; and

• three annually via virtual capabilities (as defined in Task 2)

For the one face-to-face annual meeting, the Contractor shall coordinate and reimburse the travel, per diem, and lodging arrangements for non-local TWG members. For each such non-local TWG member, the contractor shall reimburse the non-local TWG member for travel, lodging, and per diem in accordance with federal travel regulations. The Contractor shall reimburse non-local TWG members for all reimbursable hotel, airline and ground transportation (common carrier) charges. For each such non-local TWG member, the contractor will not be paid by the Government for the actual costs incurred; instead the contractor shall be paid the fixed amount negotiated for a non-local speaker (one night), to include travel, lodging, and per diem. Each annual face-to-face annual meeting shall have a minimum of 7 non-local TWG members, for which the contractor shall be responsible for reimbursing travel, lodging and per diem. As options, the Government reserves the right the exercise up to 7 additional non-local TWG members; for each such additional non-local TWG member, the contractor shall be responsible for reimbursing travel, lodging, and per diem. No TWG member will be provided an honorarium or any additional fee. Except for the 7 baseline non-local TWG members and up to 7 additional optional non-local TWG members, meeting attendees will pay for their own travel, lodging, and personal expenses.

The membership of the TWG shall be: 15 total members; at least one 21st CCLC SEA, one 21st CCLC Subject Matter Expert (SME), one 21st CCLC subgrantee, and one ED employee. All members shall be approved by the COR.

Task 4.2 – Listening Sessions The Contractor shall assemble a minimum of three listening sessions consisting of grantees and subgrantees in the base year and each option year. The listening sessions will assist in determining the training needs of the portal audience, provide feedback on the methods used in the delivery of training and recommend functional changes to the Y4Y Professional Learning Portal. Listening sessions shall consist of the following:

• one face-to-face (in-person) listening session annually in Washington, DC at an ED Facility; and

• two listening sessions are to be held in conjunction with National, State or Regional Sponsored Conferences where a representative number of grantees and subgrantees are already in attendance. Reimbursement of expenses will not be provided.

For the one face-to-face annual listening session, the Contractor shall coordinate and reimburse the travel, per diem, and lodging arrangements for non-local attendees. For each such non-local attendee, the contractor shall reimburse the non-local attendee for travel, lodging, and per diem in accordance with federal travel regulations. The Contractor shall reimburse non-local attendees for all reimbursable hotel, airline and ground transportation (common carrier) charges. For each such non-local attendee, the contractor will not be paid by the Government for the actual costs incurred; instead the contractor shall be paid the fixed amount negotiated for a non-local speaker (one night), to include travel, lodging, and per diem. Each annual face-to-face listening session shall have a minimum of 10 non-local attendees, for which the contractor shall be responsible for reimbursing travel, lodging and per diem. As options, the Government reserves the right the exercise up to 10 additional non-local attendees; for each such additional non-local attendee, the contractor shall be responsible for reimbursing travel, lodging, and per diem. No attendee will be provided an honorarium or any additional fee.

Except for the 10 baseline non-local attendees and up to 10 additional optional non-local attendees, meeting attendees will pay for their own travel, lodging, and personal expenses.

Task 5 - Subject Matter Experts (SMEs)

The Contractor shall provide direct subject matter expertise or obtain subject matter experts to provide technical assistance in a variety of 21st CCLC related topics. Once the COR identifies a topic area which requires a subject matter expert, the Contractor shall submit:

1. The resumes of up to three proposed individuals who have a minimum of a Bachelor’s degree or equivalent experience, experience in the subject matter or technical area, and excellent analytic, writing and/or technical skills;

2. Each proposed individual’s fully burdened daily labor rate or fee; and

3. Each proposed individual’s estimate of the amount of time required to complete the project or task.

If the Contractor cannot provide three individuals for consideration for a particular task, the contractor shall provide rationale to the COR explaining why less than three individuals are available and capable of performing the work. The Contractor shall submit this information and make a recommendation to the COR within 10 business days after request for subject matter expertise is received. The COR shall review the submitted resumes and notify the Contractor of the approved subject matter expert within 10 business days after submission of resumes.

The following are examples of tasks that may be expected of the SMEs:

• Conduct case studies on specific topic areas

• Provide topic-specific on-site technical assistance to States and subgrantees

• Conduct research and produce white papers on specific topic areas

• Conduct a needs assessment

• Develop logic models

• Assist in content creation for professional learning modules

• Organize topic-specific distance learning opportunities for target audiences

• Assemble a temporary topic specific technical working group

The Contractor shall provide the direction and management of such experts and ensure the delivery of high quality services and/or products. The Contractor shall also submit draft and final products produced by each subject matter expert in accordance with a schedule that will be negotiated for each project and/or task.

Task 5.1 – SMEs Base Year For the base year, the Contractor shall subject matter expertise to provide technical assistance specifically for the topics of Expanded Learning Time (ELT) and Science Technology Engineering Mathematics (STEM) as they relate to 21st CCLC.

Task 5.1.1 – Expanded Learning Time (ELT) For the ELT topic area, the Contractor shall provide SME support to accomplish the following tasks:

• The Contractor shall assemble a temporary ELT specific Technical Working Group (TWG) to collaborate on education strategies, content creation, and informational practices as they relate to ELT in a 21st CCLC environment. This TWG shall have a membership of not more than 9 people and shall meet via virtual capabilities (as defined in Task 2).

• The Contractor shall conduct a ELT specific needs assessment to determine the technical assistance needs of the 21st CCLC grantees and subgrantees.

• The Contractor shall develop and deliver 10 ELT specific targeted on-site technical assistance sessions and 10 ELT specific targeted virtual technical assistance sessions to States and subgrantees. These 20 technical assistance sessions are in addition to and independent of Tasks 2.1 and 2.2.

• The Contractor shall, make high-quality, informed presentations at up to five national, state or regional conferences or meetings based on work accomplished under the tasks in this contract. These five presentations are in addition to and independent of Task 2.4.

Task 5.1.2 – Science Technology Engineering Mathematics (STEM) For the STEM topic area, the Contractor shall provide SME support to accomplish the following tasks:

• The Contractor shall assemble a temporary STEM specific Technical Working Group (TWG) to collaborate on education strategies, content creation, and informational practices as they relate to STEM in a 21st CCLC environment. This TWG shall have a membership of not more than 9 people and shall meet via virtual capabilities (as defined in Task 2).

• The Contractor shall conduct a STEM specific needs assessment to determine the technical assistance needs of the 21st CCLC grantees and subgrantees.

• The Contractor shall develop and deliver 10 STEM specific targeted on-site technical assistance sessions and 10 STEM specific targeted virtual technical assistance sessions to States and subgrantees. These 20 technical assistance sessions are in addition to and independent of Tasks 2.1 and 2.2.

• As they relate to the 21st CCLC program, coordinate STEM initiatives with other stakeholder groups such as offices within the Department, other federal agencies, SEAs, and subgrantees.

o The contractor shall develop a draft STEM initiative sustainability plan o The contractor shall support the planning, coordination and implementation of a process evaluation for continuous improvement

Task 6 - Y4Y Enhancements and Professional and/or Educational “Credit for Completion”

Enhancements to the Y4Y Portal are subject to EVM reporting requirements and will be provided on separate task orders to this contract. Examples of enhancements could include changes to the Y4Y user interface, additional module/content creation, additional reporting requirements, studies, analysis or white papers.

Task 6.1 - Professional and/or Educational “Credit for Completion” The Contractor shall perform a detailed analysis to determine costs and schedule associated with the development and implementation of professional and/or education credit for training/course completion. The Contractor shall prepare an Y4Y Credit for Completion Analysis and Implementation Plan and present it to the COR no later than March 30, 2015. The Plan shall include at a minimum the following items:

• A feasibility analysis that identifies at least two possible methodologies for the awarding of professional and/or education credit for training/course completion

• A plan for refining existing modules to allow for professional and/or education credit for training/course completion

• A plan for accommodating new content (Task 3.2) to also allow for professional and/or education credit for training/course completion.

• Costs and high level schedule for implementation; personnel needs; program risks; and future cost ramifications.

Upon acceptance and approval of the Plan by the COR, the CORwill determine when implementation will begin.

Task 6.2 - Y4Y Enhancements (OPTIONAL) The following enhancements to the Y4Y Portal are required during the contract Base Period:

• Enhance portal user experience to ensure optimal functionality, performance, and reliability.

• Allow users the ability to customize trainings to meet their specific needs

Task 7 - Operations & Maintenance

Operate and maintain the existing web portal in accordance with established practices:

• Ensure Y4Y remains fully functional and stable (e.g. bug-fixes, security upgrades, software patches), and complete all required system, hardware and software upgrades in a timely manner. Note: all upgrades or enhancements shall be coordinated with ED.

• Interface daily with customers and other Y4Y personnel to maintain a high quality of support for Y4Y. Responsibilities shall include system usage training for the customers, and rapid response to all technical problems reported to the Contractor by the customers or by Y4Y staff.

• Be expected to install and maintain all Y4Y hardware components and keep track of them via an automated reporting and tracking tool.

• Ensure portal is transitioned and fully operational by September 25, 2014

Task 7.1 - Asset Management Support The Contractor shall provide a full range of Asset Management Support including, but not limited to:

• Shipment of Automated Data Processing (ADP) assets, including coordination with shipping and receiving departments to ship and track inventory assets;

• Receipt of ADP assets including moving, unpacking, ensuring distribution and testing, and completing all required documentation;

• Perform installation and troubleshooting of hardware as needed;

• Dispose of aging equipment ensuring that all information has been wiped/erased in accordance with applicable security regulations;

• Work with manufacturers in connection with upgrades and repairs of equipment, memory, processor upgrades, Operating Systems (OS) issues, all hardware replacements and registration of those assets; and

• Providing a report listing updates to existing assets every six months

The Contractor is responsible for ensuring adequate staffing for scheduling, performance, and reporting of these assigned tasks. The Contractor shall provide oversight of all tasks at Y4Y equipment locations.

The current portal is in a virtualized environment on leased co-located servers. In the event that the contract requires the portal to change physical environments, there will be no hardware to transition. There will be Government Furnished Information (GFI) in the form of a fully backed up website to include all web pages and database files in a digital format (i.e. either transferred to the new contract via secure FTP or via CDs/DVDs/portable hard drive.

Task 7.2 - Compliance with ED IT Security Policy The contractor, and all sub-contractors, shall comply with the Department of Education’s IT security policy requirements, specifically those set forth in the ‘Handbook for Information Assurance Security Policy (OCIO-01)’, and other applicable procedures and guidance. The contractor, and all sub-contractors, shall develop and implement management, operational and technical security controls to assure required levels of protection for information systems. The contractor, and all sub-contractors, shall further comply with all applicable Federal IT security requirements including, but not limited to, the Federal Information Security Management Act (FISMA) of 2002, Office of Management and Budget (OMB) Circular A-130 Appendix III, Homeland Security Presidential Directives (HSPD), the National Institute of Standards and Technology (NIST) standards and guidance, and the Federal Risk and Authorization Management Program (FedRAMP) requirements and guidance.

These security requirements include, but are not limited to, the successful Security Authorization (SA) of the system (includes commercially owned and operated systems managed by the commercial vendor and its sub-contractors, supporting Department programs, contracts, and projects); obtaining a full Authority to Operate (ATO) before being granted operational status; performance of annual self-assessments of security controls; annual Contingency Plan testing; performance of periodic vulnerability scans; updating all information system security documentation as changes occur; and other continuous monitoring activities, which may include, mapping, penetration and other intrusive scanning. Full and unfettered access for the Department’s third party Managed Security Services Provider (MSSP) must be granted to access all computers and networks used for this system. Additionally, when there is a significant change to the system’s security posture, the system (Federal and commercial prime- and sub-contractors included) must have a new SA, with all required activities to obtain a new ATO, signed by the Authorizing Official (AO).

System security controls shall be designed and implemented consistent with NIST SP 800-53 Rev 4, ‘Recommended Security Controls for Federal Information Systems and Organizations.’ All NIST SP 800-53 controls must be tested / assessed no less than every 3 years, according to federal and Department policy. The risk impact level of the system will be determined via the completion of the Department's inventory form and shall meet the accurate depiction of security categorization as outlined in Federal Information Publishing Standards (FIPS) 199, ‘Standards for Security Categorization of Federal Information and Information Systems.’

System security documentation shall be developed to record and support the implementation of the security controls for the system. This documentation shall be maintained for the life of the system. The contractor, and all sub-contractors, shall review and update the system security documentation at least annually and after significant changes to the system, to ensure the relevance and accurate depiction of the implemented system controls and to reflect changes to the system and its environment of operation. Security documentation must be developed in accordance with the NIST 800 series and Department of Education policy and guidance. System security documentation may include but is not limited to:

• Risk Management Plan

• IT Contingency and Disaster Recovery Plan

• Configuration Management Plan and Repository

• Change Management Plan

• Requirements Management Plan

• Functional Requirements Document

• System Design Document

• NIST Self-Assessment (Annually)

• Remediation Plan (Plan of Actions and Milestones Submissions)

• System Security Plan

• Department of Education Data Sensitivity

• Incident Response Plan

• Security Controls Assessment Plan

• System Characterization Document

• System Disposal Plan

The contractor, and all sub-contractors, shall allow Department employees (or Department designated third party contractors) access to the hosting facility to conduct SA activities to include control reviews in accordance with NIST SP 800-53, Rev. 4 and NIST SP 800-53A. The contractor, and all sub-contractors, shall be available for interviews and demonstrations of security control compliance to support the SA process and continuous monitoring of system security. In addition, if the system is rated as ‘Moderate’ or ‘High’ for FIPS 199 risk impact, vulnerability scanning and penetration testing shall be performed on the hosting facility and application as part of the SA process. Appropriate access agreements will be reviewed and signed before any scanning or testing occurs.

Identified deficiencies between required NIST SP 800-53 Rev. 4 controls and the contractor’s, and all sub-contractor’s implementation, as documented in the Risk Assessment Report, System Security Plan (SSP) and Security Assessment Report (SAR), shall be tracked for mitigation through the development of a Plan of Action and Milestones (POA&M) in accordance with the ‘Handbook for Information Assurance Security Policy (OCIO-01).’ Depending on the severity of the deficiencies, the Department may require remediation before an ATO is issued.

All awarded contracts shall ensure that:

• Their IT product/system is monitored during all hours of operations using entrusted detective/preventive systems;

• Their IT product/system has current antiviral products installed and operational;

• Their IT product/system is scanned on a reoccurring basis;

• Vulnerabilities are remediated in a timely manner on their IT product/system; and

• Access/view for cybersecurity situational awareness on their IT product/system is made available to the Department CIRC (cyber incident response capability).

Task 7.3 - Internet Protocol version 6 (IPv6) For IPv6, the contractor shall provide Commercial off-the-shelf (COTS) solutions that are IPv6 capable. An IPv6 capable system or product shall be capable of receiving, processing, transmitting and forwarding IPv6 packets and/or interfacing with other systems and protocols in a manner similar to that of IPv4. Specific criteria to be deemed IPv6 capable are:

• An IPv6 capable system that meets the IPv6 base requirements defined by the USGv6 Profile (http://www.antd.nist.gov/usgv6/profile.html).

• Systems being developed, procured or acquired shall maintain interoperability with IPv4 systems/capabilities.

• Systems shall implement IPv4/IPv6 dual-stack and shall also be built to determine which protocol layer to use depending on the destination host it is attempting to communicate with or establish a socket with. If either protocol is possible, systems shall employ IPv6.

The contractor shall provide IPv6 technical support for system development, implementation and management.

Task 7.4 - Reporting of Data Security Breaches If there is a suspected or known breach/disclosure of PII due to lost, theft, intercepted transfer, or other, the contractor must ensure that this breach is reported to the agency as soon as the contractor has knowledge of it. Per Office of Management and Budget Memorandum M-06-19, Federal agencies have a requirement to report breaches of PII security to a Federal incident response center. OESE must notify the department within 30 minutes of discovering the incident (and the agency should not distinguish between suspected or confirmed breaches). The data security plan must be written to reflect this requirement, and the contractor must provide http://www.antd.nist.gov/usgv6/profile.html sufficient notification and documentation of the suspected loss, as it is understood at the time of notification to the agency for this requirement to be met. Follow-up reports of the final status of loss events will also be prepared by the contractor within a reasonable period of time as advised by the OESE COR.

Task 7.5 - Compliance with Section 508 of the Rehabilitation Act In 1998, Congress amended the Rehabilitation Act to require Federal agencies to make their electronic and information technology accessible to people with disabilities. Inaccessible technology interferes with an individual's ability to obtain and use information quickly and easily. Section 508 was enacted to eliminate barriers in information technology, to make available new opportunities for people with disabilities, and to encourage development of technologies that will help achieve these goals. The law applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology. Under Section 508 (29 U.S.C. 794d), agencies must give disabled employees and members of the public access to information that is comparable to the access available to others. All deliverables developed under this work statement will comply with the Section 508 of the “Americans with Disabilities Act” technical standards for web and software accessibility located at 36 CFR 1194.21 and 1194.22.

SCHEDULE OF DELIVERABLES

Base Year and Option Years 1, 2 & 3

ED should receive at least 1 electronic copy of all document deliverables and 1 hardcopy.

TASK NO. DELIVERABLES DUE DATE SUBMISSION

TO:

Task 1:

Contract/Project Administration

1.2.1 Phase-In Plan 10 calendar

days after initial contract award, and 10 calendar days after each subsequent option period, if exercised

CS/COR

1.2.2 Phase-Out Plan 90 days after

initial contract award, and 10 calendar days after each subsequent option period, if exercised

CS/COR

1.3 Project Management Support Every 30 days

after contract award for all contract years

CS/COR

1.3 Project Management Plan 10 calendar

days after initial contract award, and 10 calendar days after each subsequent option period, if

CS/COR

exercised

1.3 Integrated Project Schedule Initial

submission 30 calendar days after initial contract award, and 30 calendar days after each subsequent option period, if exercised

Ongoing updates throughout life of contract

CS/COR

1.4 Project Effectiveness Plan 60 days after

initial contract award

CS/COR

1.4 Semi-Annual Effectiveness

Report

Every 180 days after contract award for all years

CS/COR

Task 2: Technical Assistance

2.1 20 Targeted On-site Trainings All years CS/COR

2.2 20 Targeted Virtual Trainings All years CS/COR

2.3 Quarterly Virtual Technical

Assistance

Beginning 120 days after award date, and not less than every 90 days thereafter

CS/COR

Task 3: Content Creation and Integration

3.1 Third Party Content

Integration

All years CS/COR

3.2 Content Creation—1 content

module

End of base year

3.2 Content Creation—2 new

content modules

End of each option year

CS/COR

3.3 Content Upgrades—1 update End of base

year

CS/COR

3.3 Content Upgrades—2 updates End of each

option year

CS/COR

Task 4:

Stakeholder Collaboration

4.1 Technical Working Group Every 90 days

for all years

CS/COR

4.2 Listening Sessions Every 120 days

for all years

CS/COR

Task 6: Y4Y Enhancements and Professional and/or Educational “Credit for Completion”

6.1 Professional and/or

Educational “Credit for Completion” Analysis

March 30, 2015 CS/COR

Task 7: Asset Management Support

7.1 Asset Update Report Every 180 days

for all contract periods

CS/COR

7.2 System Security

Documentation

At least every 180 days for all years