ESEP150053AP_Master_BPA_PWS.doc

ESEP150053AP

Tuesday, May 26, 2015

U.S. Department of Education

Readiness and Emergency Management for Schools (REMS) Technical Assistance (TA) Center Performance Work Statement (PWS)

I. INTRODUCTION

This is a performance-based work statement for the operation of the U.S. Department of Education’s (the Department), Office of Safe and Healthy Students (OSHS), Readiness and Emergency Management for Schools (REMS) Technical Assistance (TA) Center. The contractor shall provide training and technical assistance to increase the safety, security (i.e., safety that is compromised by an adversary), and emergency management capacity of state educational agencies (SEAs), local educational agencies (LEAs), schools, and institutions of higher education (IHEs) as well as to build their capacity in the five mission areas of preparedness (i.e., prevention, mitigation, protection, response, and recovery).

The REMS TA Center will serve the Department, its federal partners, SEAs, LEAs, schools (public and non-public), and IHEs. Services in school safety, security, emergency management, and the preparedness missions (prevention, protection, mitigation, response, and recovery) will be provided to both the Department’s grantees and non-grantees. Additionally, comprehensive, intensive, and customized technical assistance and training on these same topics will be provided to the Department’s grant programs and their individual grantees, in collaboration with OSHS.

A. Background National preparedness efforts, including planning, are now informed by Presidential Policy Directive (PPD) 8, which was signed by the President in March 2011 and describes the Nation’s approach to preparedness. This directive represents an evolution in our collective understanding of national preparedness, based on lessons learned from terrorist attacks, hurricanes, dangerous school and IHE incidents, and other experiences.

Using the definitions from PPD-8 as a guide and to reflect the unique characteristics of educational entities, the Department defines preparedness for schools and IHEs around five mission areas:

· Prevention means the capabilities necessary to avoid, deter, or stop an imminent crime or threatened or actual mass casualty incident. Prevention is the action that a school or IHE takes to prevent a threatened or actual incident from occurring.

· Protection means the capabilities to secure schools against acts of violence and manmade or natural disasters. Protection focuses on ongoing actions that protect students, teachers, staff, visitors, networks, and property from a threat or hazard.

· Mitigation means the capabilities necessary to eliminate or reduce the loss of life and property damage by lessening the impact of an event or emergency.

· Response means the capabilities necessary to stabilize an emergency once it has already happened or is certain to happen in an unpreventable way.

· Recovery means the capabilities necessary to assist schools affected by an event or emergency in restoring the learning environment.

Our Nation’s K-12 schools and IHEs are entrusted to provide a safe and healthy learning environment to approximately 55 million K-12 students and approximately 20 million postsecondary students. Each year, schools, and IHEs are vulnerable to natural hazards (e.g., wildfires, tornados), technological hazards (e.g., accidental release of toxins from industrial plants, hazardous materials released from major highways or railroads), biological hazards (e.g., infectious diseases, contaminated food outbreaks), and manmade threats (e.g., arson, gang violence, active shooters). While the capacity of K-12 schools and IHEs to effectively address the five mission areas of preparedness is improving, many of the hazards and threats they may face place increasingly complex demands on these institutions and their capacity, making it difficult for them. In addition, because of the myriad of demands for resources placed on SEAs, LEAs, schools, and IHEs, their ability to meet their school safety, security, emergency management, and preparedness needs is a significant challenge.

In January 2013, the President issued a plan entitled “Now Is the Time” intended to protect our children and communities by reducing gun violence. One of the four steps identified in the plan was making our schools safer. In response, the Department, in collaboration with the Departments of Homeland Security, the Federal Emergency Management Agency, Justice, the Federal Bureau of Investigation, and Health and Human Services published guides to help schools, IHEs, and houses of worship develop high-quality emergency operations plans (EOPs) which describe the roles, responsibilities, and courses of action of IHEs, districts, schools, and their community partners in creating a safe, secure school community before, during, and after an emergency: the “Guide for Developing High-Quality School Emergency Operations Plans” and the “Guide for Developing High-Quality Emergency Operations Plans for Institutions of Higher Education (IHEs)”.

Because of the critical role that EOPs play, the guides for schools and IHEs are the centerpiece of our efforts to help SEAs, LEAs, schools, and IHEs to build capacity in safety, security, emergency management, and preparedness (i.e., its five mission areas). The guides describe a flexible, six-step planning process that can be adapted to the unique characteristics of its users in collaboration with their community partners (e.g., law enforcement, fire officials, emergency managers).

In FY 2014, the Department established the Grants to States for Emergency Management (GSEM) program that provided discretionary grants to SEAs to increase their emergency management capacity to provide training and technical assistance to LEAs and to assist LEAs with improving their EOPs. These GSEM grantees, any other current or future grant programs and grantees of the Department, as well as non-grantees, SEAs, LEAs, schools, and IHEs that would benefit from the REMS TA center services, are among the target audiences of the REMS TA center.

In recognition of the increasing complexities of the threats and hazards facing SEAs, LEAs, schools, and IHEs, as well as their limited safety, security, emergency management, and preparedness resources, the Department requires the services of a contracted service provider to continue the operation of the REMS TA Center. The contractor shall work collaboratively with the Department and help its users build their capacity by providing them with access to state-of-the-art materials and resources, as well as training and technical assistance, with particular attention to assisting them with developing and implementing high-quality, EOPs and comprehensive emergency management programs that address safety, security, emergency management, and emergency preparedness. REMS TA Center users include the Department’s grantees and non-grantees, SEAs, LEAs, schools, and IHEs and their partners.

B. REMS TA Center Program Objectives The goal of the REMS TA Center is to increase the safety, security, emergency management, and preparedness capacity for all SEAs, LEAs, schools, and IHEs (including the Department’s grantees and non-grantees). The contractor shall assist education entities and their community partners to increase safety, security, emergency management, and preparedness capacity through the maintenance of a complex and interactive Web site, the development and dissemination of materials and resources, and the provision of training and technical assistance. These virtual and in-person resources, materials, training, and technical assistance products shall address the five mission areas of preparedness (prevention, protection, mitigation, response, and recovery) with particular attention to the development and implementation of high-quality EOPs.

The primary objectives of the REMS TA Center is to collaborate with the Department to improve IHE and school safety, security, emergency management, and preparedness in the five mission areas by:

· implementing sound management processes and practices to ensure the success of the overall project, individual task orders, and individual activities while increasing capacity in IHE and school safety, security, emergency management, and preparedness of the Department’s grantees and non-grantees, IHEs, schools, LEAs, SEAs, and their community partners.

· engaging in activities to further market the REMS TA Center services and products as well as further develop collaborative efforts at the federal, state, and local levels and within the REMS TA Center community of practitioners.

· developing, updating, maintaining, and disseminating a wide range of interactive and non-interactive IHE and school safety, security, emergency management, and preparedness materials and resources in a wide range of modalities (e.g., virtual, electronic, hard copy).

· providing technical assistance and training in IHE and school safety, security, emergency management, and preparedness to IHEs, SEAs, LEAs, and schools, including the Department’s grantees and non-grantees, using a variety of means (e.g., virtually, in-person).

· maintaining and updating a user-friendly, dynamic, and interactive Web site supported by multiple databases that is also designed to support and be optimized for mobile platforms, and to serve as a high-capacity hub of IHE and school safety, security, emergency management, and preparedness resources with numerous technology features and functions.

· continuously updating its materials so that the content always reflects the most current policies, initiatives, events, and ED’s needs.

· working collaboratively with OSHS, its grantees and its partners, as well as IHE, SEA, LEA, school practitioners as applicable.

· working collaboratively with OSHS, to provide comprehensive, intensive, technical assistance and training to the Department’s grant programs and the individual grantees.

II. LEGISLATIVE AUTHORIZATION

The legislative authority for this activity is authorized by Title IV, Part A, Subpart 2 (National Programs – 20 U.S.C. 7131) of the Elementary and Secondary Education Act, as amended.

III. DEFINITIONS

For purposes of Blanket Purchase Agreement, we are establishing the following definitions. These definitions are:

Government Property: All property owned by or leased to the government or acquired by the government under the terms of this contract. It includes both government-furnished property (i.e., property in the possession of, or directly acquired by, the government and subsequently made available to the contractor) and property acquired or otherwise provided by the contractor for performing the activities within the task orders and to which the government has title. Government property includes, but is not limited to, the REMS TA Center’s name, logo, publications (e.g., REMSExpress, brochures, curricula, or reports), measurement instruments, databases, toll-free telephone numbers, and online resources, including training and technical assistance materials (e.g., technical assistance, training courses, webinars, online courses, interactive tools), courses, downloadable software and its code, and electronic and non-electronic tools, as well as the Web site, its domain name, and any related features, functions, and databases. For internet-based products, property includes items in a transferable format as well as its intended use format. Property includes all products developed, maintained, and enhanced throughout the period of the grant.

High-Quality School Emergency Operations Plan (EOP): A comprehensive emergency operations plan that encompasses the five preparedness mission areas: (1) prevention, (2) protection, (3) mitigation, (4) response, and (5) recovery and that is—(i) adequate, (ii) feasible, (iii) acceptable, (iv) complete, and (v) compliant per the Guide for Developing High-Quality School Emergency Operations Plans and the Guide for Developing High-Quality Emergency Operations Plans the Guide for Developing High-Quality Emergency Operations Plans for Institutions of Higher Education (IHEs) available at http://www2.ed.gov/about/offices/list/oese/oshs/emergency-operations-guides.html

Institution of Higher Education (IHE): Institution of Higher Education (IHE) has the meaning given the term in section 9101 of the ESEA.

Local Educational Agency (LEA): Local educational agency (LEA) has the meaning given the term in section 9101 of the ESEA.

Products: Services that include, but are not limited to, statewide measurements, district-, IHE-, and school-based surveys, need assessments, survey guide books, code books, guidance documents, reports, summary briefs, reports, virtual and in-person training curricula, delivery of virtual and in-person trainings and workshop materials, archived Webinars, related Webinar materials, on-line course modules, public service announcements, posters, videos, online and downloadable software, tools, audiocassettes, electronic interactive tools, electronic downloadable tools, and publications. Virtual and printed publications include but are not limited to books, implementation guides or monographs, literature reviews, fact sheets, publications, professional articles, and brochures.

School Environment: The physical, academic, nonacademic, and disciplinary settings; the safety, security, emergency management, preparedness and wellness supports offered to students, staff, and families.

Schools: Consists of public, non-public, and charter entities that provide education as determined under state law.

Services: Sum total of assistance and products provided by REMS TA Center, including but not limited to the REMS TA Center logo and Web site; survey planning, design, development, data analysis and reporting; needs assessment and evaluation activities; research activities; support for program interventions and implementation; online and in-person technical assistance, online and in-person training and technical assistance, workshops, and presentations; and development and dissemination of customized resource information and products, Web site features, functions, and databases.

State Educational Agency (SEA): State educational agency (SEA) has the meaning given the term in section 9101 of the ESEA.

Subject-Matter Experts: Individuals with a demonstrated expertise who are professionals and practitioners in, among other areas, school safety, security, emergency management, and preparedness; developing EOPs; conducting assessments; IHE and school administration; evaluation and survey analysis and reporting; incident data collection, including incident-based data collection; youth mental health and wellness; program planning; program implementation and evaluation; product development; designing and delivering training; resource dissemination; sustainability planning; Web site development and maintenance; Web-based database development and maintenance; online training development and administration; and software development and administration.

Technical Assistance: Consists of consultations, information, referrals, and other assistance on specific issues, topics, or problems as requested by the Department, IHEs, SEAs, LEAs, schools, the Department’s grantees and other stakeholders. The contractor disseminates materials collected, developed, adapted, and adopted for this assistance. Technical assistance may proceed, follow, or be combined with training activities as well as tools and resources.

Training: Instruction directed toward imparting knowledge, skills, and attitudes supportive of change by engaging, informing, equipping, and motivating trainees toward the development and implementation of action plans responsive to the specific need or circumstance of the trainees. Virtual and in-person training may consist of various formats (e.g., meetings, conferences, workshops, seminars, Webinars, online courses, and other computer-assisted tools or tutorials).

IV. PERIOD OF PERFORMANCE

The ordering period for task orders under this contract shall be 60 months. Task orders awarded under this BPA have a period of performance independent of the base BPA. In cases where legislative authority exists to extend a task order beyond, task orders can be extended by following the same policies and procedures required in the case of a normal contract.

V. TYPES OF SERVICES TO BE PROVIDED

The nature and scope of the work shall include maintaining and enhancing the REMS TA Center web site; continually developing and providing technical assistance and training in school safety, security, emergency management and preparedness capacity building to IHEs and schools (public and nonpublic), LEAs, SEAs, and the Department along with their community partners to educational entities and their community partners; and supporting and collaborating with the Department and applicable partners in activities aimed at directly and indirectly increase capacity building. REMS TA Center is designed to cover a variety of needs by providing a wide variety of technical assistance, training, and support requirements into a number of tasks.

A. Scope of Work

The scope of this contract shall encompass training, technical assistance, and support for the planning and implementation tasks related to individual tasks orders.

B. Anticipated Task Order Tasks and Activities

Task orders issues under this contract shall contain the following sections: background; program specific requirement for BPA tasks; detail activity quantities required to develop a firm-fixed price such as the number of webinars to be supported, number of trainings and technical assistance services to be developed, number of trainings and technical assistance services to be provided; required deliverables; and a schedule of deliverables.

The services and products contemplated under the REMS TA Center are divided into the six tasks described below. Individual task orders may include all or a subset of the six tasks and the associated activities.

Task 1: Project Management and Administration

The contractor shall perform all administrative activities necessary to manage the contract and task orders, and communicate with the Department during the performance of this contract. The contractor shall plan for the corporate review and oversight of the project, including the administration, fiscal management, and fiscal control. The contractor shall ensure that all services and products are of the highest quality and maintain standard appearance of all products. The contractor shall review all materials, products, publications submitted to ensure the highest professional quality, appropriateness to the target audiences, captures changes, reflects the field, and complies with the Department’s guidelines.

Such tasks shall include, but are not limited to, submitting a project management plan describing how the contractor will carry out all tasks, conducting and attending meetings, submitting meeting agendas and minutes, producing progress reports, timelines and project summary reports. Each task order shall describe the project administration activities and schedule necessary for that task order. At the end of the contract, to ensure uninterrupted operation of the REMS TA Center, the Task 1 will also include subtasks to arrange for the seamless transfer of all government-owned property by the end date of the contract.

Typical deliverables for this activity may include a project management plan for each task order, meeting summaries, bi-monthly reports, presentations, and electronic timeline files.

Task 2: Information Awareness Activities The contractor shall engage in activities to facilitate capacity-building and implementation at the state and local levels as well as further develop collaborative efforts at the federal, state, and local levels with preparedness practitioners. The contractor shall engage in efforts to raise awareness of its free services and products for use by all educational entities in collaboration with their community partners as well as its available products, services, and resources as it relates to general planning, responding to current events, and addressing emerging issues.

Typical deliverables for this activity include a dissemination plan and the following activities: purchasing physical materials to disseminate showing the REMS name, logo, and contact information (e.g., brochures, mouse pads, pens, keychain, flashlights), participating in meetings, trainings, and conferences as presenters and/or exhibitors, populating participants and generating listserv updates and newsletters, creating blogs and newsletter for OSHS and the Department, developing social media profiles and using to provide continuous updates to the field.

Task 3: Develop, Maintain, and Continually Update Training and Technical Assistance Materials Based on the needs of IHEs, SEAs, LEAs, and schools, including the Department’s grantees and non-grantees; advancements in IHE and school safety, security, emergency management and preparedness; and federal initiatives, the REMS TA Center shall develop training and technical assistance materials while maintaining and continually updating its collection of training and technical assistance materials. The training and technical assistance materials shall impart guidance, knowledge, expertise, information, and additional resources aimed at capacity-building.

In consultation with the COR and OSHS, the contractor shall identify and develop training and technical assistance topics related to IHE and school safety, security, emergency management, and preparedness. Training and technical assistance topics shall be based on the current federal guidance released June 18, 2013 and related advanced topics. Topics may include but are not limited to: preparedness and its five mission areas, six-step planning process, and planning principles as defined by the Department in the “Guide to Developing High-Quality School Emergency Management Operations Plans (EOPs)” and the “Guide to Developing High-Quality Emergency Management Operations Plans (EOPs) for Institutions of Higher Education (IHEs),” the National Incident Management System (NIMS), Incident Command System (ICS), communications, providing for persons with disabilities including functional and access needs, developing exercise programs, program sustainability, partnership building, integrating infectious disease and other hazards and threats with emergency operations planning, assessment, and evaluation.

The contractor shall ensure that OSHS is prominently cited on all products, publications, and stationery, as well as during service delivery. All documents will be reviewed and approved by the COR and staff from the OSHS and, when applicable, the Office of Communications and Outreach (OCO) and subsequently prepared in a manner that is Web-ready and printer-friendly ready. The contractor may hire and support practitioners with subject-matter expertise, as applicable, to contribute to the development of REMS TA Center training materials; however the contractor shall be responsible for ensuring the consistency and the development and delivery of high-quality products and services.

Typical deliverables for this activity include, but are not limited to:

· Identifying, collecting, and maintaining resources and active referral links;

· Researching and analyzing information on relevant topics and upon request;

· Conducting literature reviews or researching the availability of tools and resources on various topics, and upon request;

· Conducting needs assessments and analyzing data, including Government Performance and Results Act (GPRA) data;

· Developing new products and services, as well as maintaining and enhancing products and services such as:

(a) Guidance, publications, and resource documents;

(b) Virtual and in-person training courses, curricula, webinars, and related resources (e.g., registration, folders, agenda, resources sheets);

(c) Fact sheets, reports, literature reviews, and summaries (e.g., listservs, communities of practice (CoP), Web chat discussion summaries);

(d) Tools (e.g., downloadable software, online interactive tools, survey instruments); and

(e) Social media Web site profiles (e.g., Twitter).

Task 4: Provide Technical Assistance, Trainings, and Support to OSHS Grantees and Other Clients The contractor shall provide high-quality, expert, customized technical assistance, trainings, and support in school safety, security, emergency management, and the preparedness missions (prevention, protection, mitigation, response, and recovery) for REMS TA Center users, educational entities, the Department’s grantees, OSHS staff, and its partners through a diverse set of delivery methods. The contractor shall provide intensive, customized training and technical assistance to the Department’s grant programs and the individual grantees. The expert assistance shall be provided virtually (e.g., online courses, webinars, virtual meetings), by telephone and email, as well as through in-person trainings and meetings related to IHE and school safety, security, emergency management, and preparedness, with particular attention to developing high-quality EOPs.

The contractor shall identify applicable audiences; set training agendas; and develop and provide subject-matter expertise when applicable. The contractor shall be responsible for providing all training, training materials, online and onsite support during in-person training and meetings, conduct an evaluation/feedback survey of each training session. The contractor should note that the REMS TA Center is encouraged to use state-of-the-art technology in the development and delivery of training.

All TA support initiatives and sessions shall be documented in the appropriate form. For example, notes shall be provided from site visits, annual Government Performance Reporting Act (GPRA) data will be analyzed, an agenda shall be provided for meetings or guest lectures, and TA requests and protocols shall be provided for customer-requested TA visits and resource sheets developed.

The contractor shall establish and maintain:

· a dedicated phone line and voice mailbox for telecommunicating REMS TA Center users;

· a dedicated technical assistance electronic REMS TA Center email address for all communications sent on behalf of REMS TA Center team members / staff;

· access to online submission of TA requests;

· a process for creating high-quality, informative and comprehensive responses that support implementation of federal guidance and the goals of OSHS grant programs; and

· A process for gaining OSHS approval as applicable.

The contractor shall pilot test all new training modules, assess them to determine whether the new modules meet the needs of the intended audience; and make revision based on feedback from the pilot audience and the COR.

Typical deliverables include technical assistance responses, site visit notes, training curricula, provision of on-site training (e.g., acquire trainers, identify dates, manage advance and day of registration, analyze evaluation data), provision of virtual, online trainings (e.g., marketing flyers, registration and participation reports, provision of continual access to online learning portals, live and archived webinars); development of on online, interactive training tools and web-based applications, mobile software applications, and downloadable software, presentations, guest lecturing, meeting attendance, assistance with ED-sponsored events including grantee site visits, etc.

Task 5: Develop and Maintain a Dynamic, Interactive Web Site

The contractor shall develop, maintain, and continually update a dynamic and interactive Web site supported by multiple databases; designed to support and be optimized for mobile platforms; and support the Department’s and the federal government fast-paced environment. The Web site shall serve as a virtual hub providing access to the REMS TA Center services and products; the most recent guidance, resources and information in IHE and school emergency management; and access to interactive resources aimed at capacity-building.

The contractor shall make the Web site accessible and offer a wide range of interactive and non-interactive safety, security, emergency management, and preparedness resources, features, and functions, including but not limited to:

· Key guidance, resources, and links;

· A news and highlights section;

· Live and archived virtual meetings, Webinars, and videos;

· Site-wide search engine and portal search engines;

· Online courses portal;

· Portal or repository for sharing tools developed by practitioners;

· Online Community of Practice (CoP);

· Live web chats.

· Interactive Tools (e.g., EOP Assess, EOP Evaluate);

· Downloadable software, EOP Assist; and

· Links to REMS TA Center social media profiles Task 6: Virtual and In-Person Meetings, Trainings, and Conferences

The contractor shall develop, maintain, and use a database comprising subject-matter experts (SME) with experience and expertise in IHE and school emergency management and preparedness, as well as developing and delivering training and technical assistance. Depending on the manner of engagement (e.g., meeting, training, provision, and development of training and technical assistance) this may include paying an honorarium, or an hourly rate or daily rate, and travel, lodging, per diem and related expenses. If the contractor believes that the tasks may be of higher quality if it included the contributions of an SME, the contractor may propose applicable SME(s). The COR shall approve all SMEs and all occasions for using an SME prior to the contractor entering into agreements with experts for work to be conducted under a task order. The contractor shall arrange and pay for travel, lodging, per diem, honorarium, and related expenses as applicable and per Federal rules and regulations.

The contractor shall plan, host, and provide all logistical support for virtual meetings, other distance-based discussions and meetings, and in-person meetings and trainings for REMS TA Center users, OSHS, and its partners, to discuss topics impacting school safety, security, emergency management, and preparedness. These discussions, meetings, and trainings may support collaborative initiatives and efforts between the REMS TA Center, the Department, SMEs, the Department’s grantees, and non-grantees in the provision and development of training and technical assistance.

The virtual events shall include the following functionalities: Allow for multiple users; have the ability for users to visually share desktop images; enable the “speaker” role to change among all participants during the virtual meeting; and can be archived and viewed after the fact as well as be disseminated as a web link.

Typical deliverables may include a summary of work performed by the contractor and subject matter experts, and deliverables from the activities performed. Some deliverables may require multiple revisions depending on the topic and content. Other deliverables will include registration, analyzed evaluation data, agendas, participant rosters, electronic and physical meeting materials, nametags, table tents, presentation collateral, signage, and meeting notes. Other typical deliverables will include creating additional training and technical assistance services or products.

Task 7: Transfer Government-Owned Property

In this PWS, government property is all property owned by or leased to the government or acquired by the government under the terms of the contract. It includes both property that is government-furnished (i.e., property in the possession of, or directly acquired by, the government and subsequently made available to the contractor) and property acquired or otherwise provided by the contractor for performing contract services and to which the government has title. Government property includes the REMS TA Center’s name, publications and materials supporting all services (e.g., brochures, in-person and online training modules and materials, software, tools, curricula, reports, technical assistance), databases, toll-free telephone numbers, supplies, and equipment as well as Web site and its domain name.

To ensure uninterrupted operation of the REMS TA Center, the contractor shall arrange for the seamless transfer of all government-owned property to the next contractor or COR by the end date of the contract. The transition plan shall be submitted to the Department for COR approval.

VII. Compliance with ED IT and Cybersecurity Policy Requirements

The contractor shall comply with the Department’s general IT requirements:

1. The Contractor’s information systems shall be developed in accordance with the ED Lifecycle Management Framework (LCM), ACS-OCIO 1-106.

2. The Contractor shall ensure that the site complies with OMB Memorandum M-03-22 http://www.usa.gov/webcontent/regs_bestpractices/omb_policies/privacy.shtml which requires the posting of privacy policy.

3. A “.gov” hostname (typically hostname.ed.gov) is required for all government funded websites under OMB Memorandum M-05-04 (http://www.usa.gov/webcontent/regs_bestpractices/omb_policies/domains.shtml) and support HTTPS-Only Standard with HSTS; see https://https.cio.gov for more details.

4. The Contractor shall ensure that any “ED-Sponsored “ content must should be identified prominently with Department of Education, and the ED.gov logo should be displayed prominently and made a link to the ED.gov homepage. The compliance policy is described in the http://www2.ed.gov/internal/wwwstds.html#sponsor.

5. The Contractor shall ensure that any non-Federal sponsored websites or content (outside of .gov, .mil, etc.) that is linked to complies with “ED.gov” Management and Publishing Policies” at http://www2.ed.gov/internal/wwwstds.html#link and the OMB Memorandum http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-04.pdf .

6. The Contractor shall not employ a new webhosting service provider. The Contractor shall host the website and its associated IT infrastructure within the boundaries and classification level of a pre-existing FISMA certified boundary that has received Authorized To Operate status by the U.S. Department of Education (ED) or the federal government’s FedRAMP program.

7. The Contractor shall support the agency’s Digital Analytics Program (DAP) in support the U.S. Digital Strategy. The COR will provide the Contractor the specific coding language when appropriate. The current code standard is:

<script language="javascript" id="_fed_an_ua_tag" src="http://www2.ed.gov/style/Universal-Federated-Analytics.1.0.js?ver=true&agency=ED"></script> <!-- START crazyegg --> <script type="text/javascript" src="http://cetrk.com/pages/scripts/0009/9201.js"> </script> <script type="text/javascript" src="http://s3.amazonaws.com/new.cetrk.com/pages/scripts/0009/9201.js"> </script> <!-- END crazyegg --> <!-- START Google Analytics Code--> <script> (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) })(window,document,'script','//www.google-analytics.com/analytics.js','ga');

ga('create', 'UA-10911895-25', 'auto');

ga('send', 'pageview');

</script> <!-- END Google Analytics Code--> The contractor, and all sub-contractors, shall comply with the Department of Education’s IT security policy requirements, specifically those set forth in the ‘Handbook for Information Assurance Security Policy (OCIO-01)’, and other applicable procedures and guidance. The contractor, and all sub-contractors, shall develop and implement management, operational and technical security controls to assure required levels of protection for information systems. The contractor, and all sub-contractors, shall further comply with all applicable Federal IT security requirements including, but not limited to, the Federal Information Security Management Act (FISMA) of 2002, Office of Management and Budget (OMB) Circular A-130 Appendix III, Homeland Security Presidential Directives (HSPD), the National Institute of Standards and Technology (NIST) standards and guidance, and the Federal Risk and Authorization Management Program (FedRAMP) requirements and guidance.

The contractor shall support the government's goal that would require the use of HTTPS on all publicly accessible Federal websites and web services. All publicly accessible Federal websites and web services shall only provide service over a secure connection. The strongest privacy protection currently available for public web connections is Hypertext Transfer Protocol Secure (HTTPS). Websites and services available over HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS going forward. See https://https.cio.gov/ for background.

These security requirements include, but are not limited to, the successful Security Authorization (SA) of the system (includes commercially owned and operated systems managed by the commercial vendor and its sub-contractors, supporting Department programs, contracts, and projects); obtaining a full Authority to Operate (ATO) before being granted operational status; performance of annual self-assessments of security controls; annual Contingency Plan testing; performance of periodic vulnerability scans; updating all information system security documentation as changes occur; and other continuous monitoring activities, which may include, mapping, penetration and other intrusive scanning. Full and unfettered access for the Department’s third party Managed Security Services Provider (MSSP) must be granted to access all computers and networks used for this system. Additionally, when there is a significant change to the system’s security posture, the system (Federal and commercial prime- and sub- contractors included) must have a new SA, with all required activities to obtain a new ATO, signed by the Authorizing Official (AO).

System security controls shall be designed and implemented consistent with NIST SP 800-53 Rev 3, ‘Recommended Security Controls for Federal Information Systems and Organizations.’ All NIST SP 800-53 controls must be tested / assessed no less than every 3 years, according to federal and Department policy. The risk impact level of the system will be determined via the completion of the Department's inventory form and shall meet the accurate depiction of security categorization as outlined in Federal Information Publishing Standards (FIPS) 199, ‘Standards for Security Categorization of Federal Information and Information Systems.’

While compliance with NIST SP 800-53 Rev. 3 is currently required, in September of 2015, compliance with NIST SP 800-53 Rev. 4, will be required instead of compliance with NIST SP 800-53 Rev. 3, and between the time of the writing of the contract and the time the Department begins to require compliance with NIST SP 800-53 Rev. 4, any discrepancy between compliance with NIST SP 800-53 Rev. 3, and NIST SP 800-53 Rev. 4, will be decided in favor of compliance with NIST SP 800-53 Rev. 4.

System security documentation shall be developed to record and support the implementation of the security controls for the system. This documentation shall be maintained for the life of the system. The contractor, and all sub-contractors, shall review and update the system security documentation at least annually and after significant changes to the system, to ensure the relevance and accurate depiction of the implemented system controls and to reflect changes to the system and its environment of operation. Security documentation must be developed in accordance with the NIST 800 series and Department of Education policy and guidance.

The contractor, and all sub-contractors, shall allow Department employees (or Department designated third party contractors) access to the hosting facility to conduct SA activities to include control reviews in accordance with NIST SP 800-53, Rev. 3 and NIST SP 800-53A. The contractor, and all sub-contractors, shall be available for interviews and demonstrations of security control compliance to support the SA process and continuous monitoring of system security. In addition, if the system is rated as ‘Moderate’ or ‘High’ for FIPS 199 risk impact, vulnerability scanning and penetration testing shall be performed on the hosting facility and application as part of the SA process. Appropriate access agreements will be reviewed and signed before any scanning or testing occurs.

Identified deficiencies between required NIST SP 800-53 Rev. 3 controls and the contractor’s, and all sub-contractor’s implementation, as documented in the Risk Assessment Report, System Security Plan (SSP) and Security Assessment Report (SAR), shall be tracked for mitigation through the development of a Plan of Action and Milestones (POA&M) in accordance with the ‘Handbook for Information Assurance Security Policy (OCIO-01).’ Depending on the severity of the deficiencies, the Department may require remediation before an ATO is issued.

All awarded contracts shall ensure that:

1. Their IT product/system is monitored during all hours of operations using entrusted detective/preventive systems;

2. Their IT product/system has current antiviral products installed and operational;

3. Their IT product/system is scanned on a reoccurring basis;

4. Vulnerabilities are remediated in a timely manner on their IT product/system; and

5. Access/view for cyber security situational awareness on their IT product/system is made available to the Department CIRC (cyber incident response capability).

Internet Protocol version 6 (IPv6)

For IPv6, the contractor shall provide COTS solutions that are IPv6 capable. An IPv6 capable system or product shall be capable of receiving, processing, transmitting and forwarding IPv6 packets and/or interfacing with other systems and protocols in a manner similar to that of IPv4. Specific criteria to be deemed IPv6 capable are:

· An IPv6 capable system that meets the IPv6 base requirements defined by the USGv6 Profile and Testing program as found here (http://w3.antd.nist.gov/usgv6/testing.html).

· Systems being developed, procured or acquired shall maintain interoperability with IPv4 systems/capabilities.

· Systems shall implement IPv4/IPv6 dual-stack and shall also be built to determine which protocol layer to use depending on the destination host it is attempting to communicate with or establish a socket with. If either protocol is possible, systems shall employ IPv6.

The contractor shall provide IPv6 technical support for system development, implementation and management System Development Standards: Information systems shall be developed in accordance with the ED Lifecycle Management Framework (LCM), ACS-OCIO 1-106.

Reporting of Data Security Breaches

If there is a suspected or known breach/disclosure of PII due to lost, theft, intercepted transfer, or other, the contractor must ensure that this breach is reported to the agency as soon as the contractor has knowledge of it. Per Office of Management and Budget Memorandum M-06-19, Federal agencies have a requirement to report breaches of PII security to a Federal incident response center. OESE must notify the department within 30 minutes of discovering the incident (and the agency should not distinguish between suspected or confirmed breaches). The data security plan must be written to reflect this requirement, and the contractor must provide sufficient notification and documentation of the suspected loss, as it is understood at the time of notification to the agency for this requirement to be met. Follow-up reports of the final status of loss events will also be prepared by the contractor within a reasonable period of time as advised by the (OESE) COR.

VIII. Section 508 Standards Accessibility Requirements The Department of Education places a priority on ensuring accessibility to Electronic and Information Technology (EIT) for all employees and external customers, including people with disabilities. ED requires that EIT procured, developed, maintained, or utilized meet the accessibility requirements under Section 508 of the Rehabilitation Act of 1973, as amended, 29 U.S.C. 794 and 794d. This is to ensure the accessibility of its programs and activities to people with disabilities, specifically its obligation to acquire, lease, or develop accessible EIT.

The EIT that is covered under the Section 508 Accessibility Standards includes any equipment or interconnected system or subsystems of equipment that is used in the creation, conversion, or duplication of data or information. The term EIT includes, but is not limited to, software applications and operating systems, telecommunications products, worldwide websites, video, multimedia, information kiosks, and office equipment (e.g., desktops, copiers, fax machines, printers, and notebook computers).

The Contractor is responsible for ensuring compliance with the applicable Section 508 standards and will be required to assist the OCIO Assistive Technology Team in performing Accessibility Reviews for any websites or applications developed under this contact. This review is a standard part of the Technical Review Board process, which can be obtained from the Contracting Officer. The Contractor is fully responsible for the cost of any remediation needed, and as such is encouraged to fully understand the Section 508 requirements prior to starting the development or modification of any covered EIT.

Additional documentation related to Section 508 and ED’s application of Section 508 and product accessibility standards can be found at the following website:

http://www.ed.gov/internal/accessibility.html ED's Requirements for Accessible Electronic and Information Technology (E&IT) Design governs all content intended for posting on ED.gov. In addition, ED provides helpful tips on how to meet the requirements of Section 508:

http://www.ed.gov/internal/accessibility.html.

� Presidential Policy Directive 8, National Preparedness. Accessible at � HYPERLINK "http://www.dhs.gov/presidential-policy-directive-8-national-preparedness" �http://www.dhs.gov/presidential-policy-directive-8-national-preparedness�

� Accessible at � HYPERLINK "http://www2.ed.gov/about/offices/list/oese/oshs/emergency-operations-guides.html" �http://www2.ed.gov/about/offices/list/oese/oshs/emergency-operations-guides.html�.