EDESuite Statement Of Objectives_v1_8-11-2021.doc

Department of Education

Federal Student Aid (FSA) Draft

Statement of Objectives (SOO)

National Student Loan Database System (NSLDS)

(Maintenance and Support)

Department of Education

Federal Student Aid (FSA)

Statement of Objectives (SOO)

EDESuite Software Operation and Maintenance August 11, 2021

Table of Contents

EDESuite Overview

Objectives

42.1 Business Operations and Software Support

42.2 Customer Assistance

52.3 Transition Support

52.4 Security and Audit Support

62.5 Optional Enhancements

6Improve the efficiency and functionality of the current EDEsuite.

Scope of Work

63.1 System Enhancements, Operations & Maintenance, Configuration Management, and Audit Support

63.1.1 System Enhancements

93.1.2 Operations and Maintenance Support

103.1.3 Change Management and Configuration Management Support

113.1.4 Security and Audit Support

133.2 Customer Service

143.3 Project Management and Quality Control

Government’s Quality Assurance and Surveillance Methods

164.1 Periodic Reviews

174.2 Monitoring

Deliverables

175.1 Deliverable Requirements

185.2 Deliverable Schedule

Constraints and Assumptions

186.1 Statutes

196.2 FSA’s Lifecycle Management and CMMI Level 3

206.3 Department/FSA Directives and Standards

206.4 Vendor Transition

216.5 EDESuite Maintenance, Support, and Operations Work Effort Assumptions

System Interfaces

Government Furnished Property

Period of Performance

Place of Performance

Appendix A: Performance Requirements

Appendix B: Reference Material

Appendix C: Acronyms

PURPOSE

PURPOSE. The outcome of the procurement will be a five-year (1-year base plus 4 1-year option years) development and Operations and Maintenance contract to begin approximately May 2022 for the continuing operation, support, and maintenance of the EDEsuite (EDExpress and Direct Loan Tools software). The solution will include the secure development and management of the software, including a minimum of three (3) releases per Award Cycle.

1 EDESuite Overview

Background:

The EDESuite is a suite of two locally installed personal computer (PC) products used by school Financial Aid Administrators (and their servicers). It has traditionally been provided free of charge by Federal Student Aid (FSA) to schools and their financial aid servicers for the purpose of facilitating their work with Title IV aid. The EDExpress product allows schools to interface both with FSA’s Central Processing System (CPS; to process Free Application for Federal Student Aid (FAFSA) application data) and Common Origination and Disbursement (COD) system (to exchange school, borrower/recipient, award, and disbursement data for Pell Grant, TEACH Grant, and Direct Loan programs.) The Direct Loan Tools product provides additional functionality, allowing schools to rebuild corrupted databases, review the efficiency of their Title IV business processes, and assisting them in reconciling their home system’s Title IV data against that of the Common Origination and Disbursement (COD) system.

As of 2020 FSA estimates approximately 1300 schools and third-party servicers from a variety of backgrounds were using EDExpress to submit Common Record files to COD, with an additional 400 organizations using the software for other Title IV business support.

As technology has improved and the need to integrate the varied systems that drive FSA has evolved, EDExpress has gone from two floppy DOS (disk operating system) disks (version 1.0, 1995) to a 116 megabyte 32-bit download product over a span of twenty-six years. Legislative initiatives, which have been numerous and frequent, have driven the software’s growth and change through this time.

The following is a description of the current functionality found in both products. More detailed information on each of these modules/applications can be found in the ED Express Desk Reference, COD Technical Reference, and Packaging Technical Reference documents. These documents are publicly available at https://fsapartners.ed.gov/knowledge-center/library.

As mentioned above, EDExpress interfaces with FSA’s CPS to process FAFSA application data, and with the COD system to transmit award and disbursement data for Pell grant, TEACH grant, and Direct Loans. To accomplish this, EDExpress offers an array of functionality to school users, which is split into multiple “modules” within the software:

EDExpress: Global Module

The Global module within EDExpress provides functionality that allows users to customize several options throughout the rest of the EDExpress product. It also allows schools to create and update demographic records, setup document-tracking letters, setup user-defined data fields, and setup system information and school identifiers. It also allows schools to fine-tune security controls over who has access to certain functions within the software, through establishment of authorized Users and User Groups. Passwords associated with individual Users are setup here. Access to FSA’s College Financing Plan (CFP) functionality is also located within this module.

EDExpress: Application Processing Module Institutions receive Institutional Student Information Records (ISIRs) from CPS containing Expected Family Contribution (EFC) data, which are imported into EDExpress via the Application Processing module. This imported data creates demographic records (referred to as shell records, or “person” records) within EDExpress. ISIRs are the basis for calculating student financial aid awards. Additionally, corrections from either an electronic ISIR already in the database or from a record on paper may be processed electronically. To create an initial application from within EDExpress, users establish a demographic record for a student, then select the FAFSA tab, which carries EDExpress users into Financial Aid Administrator (FAA) Access to CPS Online via an embedded browser, where the application is actually created. Once processed, that application in the form of an ISIR is sent back to the school and imported into the EDExpress Application Processing module, where it updates the demographic record and supplies additional information for the Financial Aid Administrator (FAA).

EDExpress: Packaging Module

The Packaging module contains all the basic activities included in tracking and awarding students Title IV Federal aid, state aid, institutional aid, and aid from outside resources. The same data acquired through the ISIR process is used to create an “electronic” award package for a student. Packaging also allows an institution to manage its total financial aid process from fund maintenance to creation of a Fiscal Operations Report and Application to Participate (FISAP) income grid. Packaged-student data may be imported into the Direct Loan module of EDExpress to create loan origination records and into the Pell or TEACH module to create grant originations. While Packaging is intended to complement the electronic process, it may also be used as a stand-alone product.

EDExpress: Direct Loan Module The Direct Loan module allows schools to exchange loan origination, disbursement, and report information with the Common Origination and Disbursement (COD) system. Currently, users of the Direct Loan software may import data from a variety of sources to create and update student loan records. These sources include importing ISIRs from the Application module, importing “Packaged” student records from the Packaging module, or importing data from the school’s home-grown or third party software solution. Users can also create student loan award and disbursement records manually. The software allows Direct Loan schools to track promissory note and disclosure statement data. This module is also responsible for compiling, translating to XML, and transmitting origination and disbursement data to the COD system, as well as importing COD Common Record acknowledgements, receipts, and response file data back into Express. This module includes functionality for importing and managing counseling results in Express. Lastly, this module also contains report writing and query functionality.

EDExpress: Pell Module EDExpress Pell module can import both ISIR records and Packaging data from the EDExpress database to automate creation of Pell records. The purpose of this module is to submit Pell Payment Applicant data for the Federal Pell Grant Program on the COD system. This information drives the funding levels for schools participating in the Pell program, with such funds being drawn down from the G5 system. Data entered into the Pell module is then compiled by EDExpress, translated to XML and transmitted to the COD system. Users can also access reconciliation tools for their Pell data via this module, including importing data from COD’s Pell MRR, Electronic Statements of Account, Pell Year-to-Date File, Pell Reconciliation File, and the Pell School Account Statement (SAS). Pell module also provides users with functionality that allows them to compare COD’s Pell SAS data against their EDExpress database (or against an imported Abbreviated Award File or Disbursement File) in order to reconcile their school’s award and disbursement data against COD’s data. , Pell module also has report writing and query functionality.

EDExpress: TEACH Grant module

Similar to Pell and Direct Loan (DL), the TEACH module allows for the creation or import of data required by the COD system to originate and disburse funds to qualified recipients. Data is exchanged with the COD system and this module has the same entry, import, export, print, query and browse capability as the other modules. Unlike Pell, an Agreement to Serve or Repay (Agreement) document is required of the recipient, but is not handled by EDExpress, except for importing the COD Response which updates the status of the Agreement. It also has report writing functionality utilizing queries.

Direct Loan Tools (standalone product) Direct Loan Tools is a standalone application that performs a number of functions for schools. First, it works in conjunction with the EDExpress Direct Loan module to allow schools to rebuild the institution’s EDExpress database electronically in the event that they have lost a portion or an entire database. It also works as a free-standing cash monitoring and Student Account Statement (SAS) comparison program. With cash monitoring, users can track cash drawdowns and returns of funds, and reconcile them with the disbursements reported to the COD system. With the Compare functionality, users can import the SAS reports produced by the COD system and compare them against EDExpress database data (or a home-grown system’s database, via external file) to perform reconciliations for Direct Loan program transaction data.

2 Objectives

EDExpress and Direct Loan Tools software is produced for FSA to distribute, free of charge, to any institution having an officially endorsed obligation with FSA to report awarding and disbursing of Title IV funds. This solution shall interface with other FSA systems for a secure exchange of data (Common Origination and Disbursement system, and Central Processing System).

The solution shall allow for data entry, importing and exporting information to and from FSA systems, storing information, producing documents for communication of information with their borrowers/recipients as well as tracking this communication. The solution must be practical and user friendly and will be offered to the FAA community at no cost.

The solution shall provide these two software tools for the total processing of Applications (via embedded browser link to FAA Access to CPS Online), PELL grants, TEACH grants and Direct Loans. All coding for the solution shall align with published ISIR information, the COD Technical Reference (available for download at https://fsapartners.ed.gov/knowledge-center/library), and the Common Record Schema(s) for the most recent three aid award cycles.

The solution shall provide customers (FAAs) with documentation similar to that currently being produced (including, but not limited to: technical references, help text, process guides, format guides, implementation guide, cover letters, desk references, electronic announcements; see List of Deliverables attachment to RFI/RFP for complete list).

The contract resulting from this procurement will establish a performance-based business arrangement with the contractor for efficient, effective, and responsive support of the EDEsuite, including collaboration with the current contractor during the transition of all duties from the current Operations and Maintenance contract to the new. It is critical that FSA’s programs deliver world-class customer service during the transition at the lowest cost without sacrificing service levels or quality and without disruption or degradation of services.

The execution of this contract will provide support to the EDEsuite for several key objectives. Specifically, the contractor will be responsible for 1) Business Operations and Software Development and Support, 2) Customer Assistance, 3) Transition Support, and 4) Security and Audit Support. The contract may also potentially include (depending on contractor responses) 5) additional work to incrementally improve the efficiency and functionality of the software.

2.1 Business Operations and Software Support

Maintain, support, and operate the EDESuite software to support FSA in its goal of supporting financial aid administrators in their primary business functions. This includes support for annual award year cycle changes to the software (referred to also as “Annual Development”), as well as periodic changes (anywhere from 5-15 on average, annually) driven by legislative, regulatory, technology, or other business changes. Software changes require participation in the FSA Enterprise and Partner Participation Organization (PPO) change management processes. This objective also requires vendors to follow industry best practices with regard to development, configuration management and security. Maintenance support and operations shall be performed with emphasis on excellent customer service and measurements of performance.

2.2 Customer Assistance

Customer assistance involves providing full-service help to all EDEsuite customers (by phone or by email). Customers may include schools, third party servicers, ED staff, and other ED contractors. School and third-party servicer users may require technical assistance with the business services provided by the software. Assistance topics include, but are not limited to: website security, navigation of the website, updating data on the database, batch processing, user reports/queries, technical specifications, interpreting XML output, reports, and production control.

Customers will require a central source for resolving software problems (bugs, deficiencies, training issues) that impede their process of awarding of financial aid to students.

Responding to the users requesting technical assistance as described above needs support from professionals with higher education financial aid experience. The successful vendor proposal will contain strong evidence of customer service staff with strong subject matter backgrounds in Title IV aid processes and data. It will also demonstrate that these staff members are able to combine that background with a knowledge of how FSA systems interact with one another and with EDE Suite to successfully distribute and administer Title IV aid.

Customer Support should be available to Spanish-speaking customers. And international users need to be able to contact Customer Support in the same manner as the continental United States customers (e.g. if unable to reach an 800 number from abroad, there should be a backup number available). The hours of availability for customer help need to reflect customer needs across United States time zones.

Additional customer help includes providing formal training for ED staff on EDEsuite, its functions and uses, as well as providing training for school users in PC labs and sessions at various student financial aid conferences. The contractor shall also maintain and update training materials, training data sets, and training presentations as necessary.

Customer support also includes preparation of user documentation and assistance with interpreting the documentation.

2.3 Transition Support

This solution’s successful offeror will partner with the current EDExpress contractor to transition all O&M duties, system code, documentation, and current EDEsuite functionality over a four to six month period after the contract is awarded. The contractor shall provide FSA with a transition plan, and shall support a transition that is transparent to system users, data providers and data consumers.

2.4 Security and Audit Support

Abide by all applicable federal and FSA rules governing (but not limited to) system access and protection of personally identifiable data. Provide support to the FSA Security Division in managing interactions with auditors reviewing the EDEsuite for A-123, Financial Statement, Inspector General (IG), Government Accountability Office (GAO), and other audits that may be conducted of EDEsuite. Support includes responding to audit inquiries, providing evidence for findings, remediation plans for findings, and executing remediation within the required deadlines of the Corrective Action Plans (CAP).

2.5 User Interface Overhaul and other Optional Enhancements

The current product is 26 years old in 2021. FSA is seeking to modernize the look and feel of the software's user interface, and to improve overall ease of use for our users, while retaining the existing functionality set.

Optional development objectives include:

1)combining the current functionality currently distributed across both pieces of software in the EDESuite into a single software product;

2)aligning TEACH grant date ranges for COD’s Payment Period Start Date and Enrollment Date with the ranges currently used by Pell program;

3)updating EDESuite’s Product Registration functionality in order to switch over the current "reminder" notices we send users to a grace period model, where, absent a product registration response from the user, the product registration will display every time the software is started until a response is received.

3 Scope of Work

Identified in this section is the scope of work necessary to maintain and support the EDEsuite and its business functions effectively and efficiently. The scope of work is comprised of the following major components.

3.1 System Enhancements, Operations & Maintenance, Configuration Management, and Audit Support The Contractor shall provide technical support to maintain the operation of EDESuite business functionality while completing system enhancements. The contractor shall also provide technical support to track and resolve software and operational issues. Finally, this area of scope includes managing the configuration of EDESuite software assets, as well as working with Information System Security Officer (ISSO) on security compliance and audit support. The Contractor shall provide the following services:

3.1.1 System Enhancements

The Contractor shall provide the capability to enhance EDEsuite on an as-needed basis following mature, sound processes to ensure predictable outcomes by effectively managing the scope, schedule and effort on agreed-upon change requests. The scope of EDEsuite enhancements requires that the contractor:

3.1.1.1 Define and implement enhancements to keep pace with changes in legislation, policy, business and technology requirements.

3.1.1.2 Define and implement enhancements to maintain proper interfaces with internal and external systems and technical infrastructure components.

3.1.1.3 Manage functional requirement changes.

3.1.1.4 Determine a release schedule for each year with a proposed level of requirements changes that can be accommodated.

3.1.1.5 Work through FSA’s Business Operations and Enterprise Change Management processes to implement new requirements, including “Rollover” (annual award cycle) and “Enhancement” changes.

3.1.1.6 Effectively manage change requests from FSA providing ROMs, proposals, alternative solutions, etc. as requested in the change request within allotted time periods.

3.1.1.7 Provide thorough project management support ensuring control of scope, schedule and effort, and performing analysis on development, maintenance, and enhancement projects, conducting regular status meetings as agreed upon with FSA for change,

3.1.1.8 Provide thorough impact assessment for change requests to assure effective implementations of change requests occur without unintended consequences to other FSA applications and external parties.

3.1.1.9 Define detailed requirements ensuring specificity of customer requirements are appropriately detailed and traceable throughout development lifecycle.

3.1.1.10 Provide detailed design artifacts that appropriately describe, chart, and illustrate the design approach that fully meets detailed requirements.

3.1.1.11 Perform comprehensive approach to testing application changes to include planning, scripting, requirements traceability, reporting results and risk mitigation and effectively communicate to FSA.

3.1.1.12 Create a robust testing dataset with sufficient test data to conduct all phases of testing completely.

3.1.1.13 Perform system testing, 508 compliance testing, and user acceptance testing in accordance with best practices. Maintain separate testing environments as necessary to ensure testing efforts are not delayed nor their results contaminated due to concurrent testing efforts (e.g. being unable to conduct UAT due to performance or system testing efforts currently underway on one environment).

3.1.1.14 Provide a testing facility and all necessary equipment and data connections for use by FSA user acceptance testers.

3.1.1.15 Conduct and support intersystem testing between EDESuite and other trading partners, both inside and outside ofFSA. The contractor shall provide resources, interface control documents, test data, and test cases/scenarios in support of intersystem testing.

3.1.1.16 Code and unit test application changes as articulated in the detailed design to ensure requirements are met.

3.1.1.17 Conduct implementation planning and execution:

3.1.1.17.1 Provide thorough approach to communicating changes to the EDEsuite through newsletters, web messages, updated user guides/layouts, training/conference materials, collaboration with FSA Communications, etc., as appropriate to the change.

3.1.1.17.2 Conduct effective controls of development environments to include development, user acceptance, production and training through Test Readiness Review and Production Readiness Review processes and procedures and provide materials to FSA.

3.1.1.17.3 Provide post production support per FSA agreed period.

3.1.1.18 Ensure compliance with sections 504 and 508 of the U.S. Rehabilitation Act.

3.1.2 Operations and Maintenance Support

3.1.2.1 Provide technical resources to keep the EDESuite software working efficiently and effectively.

3.1.2.2 Ensure continued availability of all EDESuite business functions (See High Level Requirements document and ED Express Desk Reference, COD Technical Reference, and Packaging Technical Reference documents for current functionality).

3.1.2.3 Provide new and/or update existing documentation (e.g. User Documentation and Notifications, Functional Requirements, Functional Specifications, and Detail Design Specifications) to reflect any change to software, processes, and procedures.

3.1.2.4 Coordinate with appropriate FSA-designated contractors in order to post EDESuite software updates to FSA’s public download sites.

3.1.2.5 Provide support for application production problems.

3.1.2.6 Provide database administration support for the product.

3.1.2.7 Maintain a continuous security authorization for the development and maintenance of the EDESuite.

3.1.2.8 Provide application software maintenance (e.g. software fixes) and meet established timelines per Configuration Control Board (CCB) approval and priority setting.

3.1.2.9 Perform unit testing.

3.1.2.10 Perform validation of programming for both results and performance.

3.1.2.11 Ensure all system, application, and procedural documentation is complete, updated, and accurate.

3.1.2.12 Provide monthly CCB and maintenance progress reports to FSA.

3.1.2.13 The contractor shall participate in capacity planning and evergreening activities.

3.1.2.13.1 Evergreening support may include planning and scheduling, impact analysis, code changes, coordination, communication, testing activities, and making recommendations to FSA regarding future capabilities of the EDESuite software.

3.1.2.13.2 Implement hardware and software upgrades and patches to ensure that the solution evolves along with FSA’s enterprise standards and industry best practices.

3.1.2.14 EDESuite contractor personnel must attend all critical EDESuite production meetings and communicate any pertinent information through emails, phone calls to the FSA production liaison.

3.1.2.15 Comply with the FSA Software License Management process. Refer to the Technology Office Infrastructure Operations Group Concept of Operations for additional information. https://fsa.share.ed.gov/TOSL/PBLSH/TOIOGConOps.pdf

3.1.3 Change Management and Configuration Management Support

Change Management

3.1.3.1 Adhere to FSA's Enterprise Change Management and Business Operations Change Management processes to implement new requirements.

3.1.3.2 For each change control received, provide thorough impact assessment for change requests including understanding of the high-level requirements, contractor assumptions and risks, an estimated implementation date/schedule, feasibility, and an assessment of all impacts to interfacing systems/services, both internal/external to FSA.

3.1.3.3 Obtain FSA approval of system changes prior to production implementation.

Configuration Management

3.1.3.4 Document baseline configurations and establish policy, procedures, guidelines, and accountability for modification of baseline configurations through creation and maintenance of a Configuration Management Plan.

3.1.3.5 Establish a configuration control board, with oversight responsibility for configuration change management.

3.1.3.6 Monitor and ensure configuration settings compliance with all applicable federal IT security policies and regulations.

3.1.3.7 Manage application software changes.

3.1.3.8 Control configured application components.

3.1.3.9 Provide inventory control of government items.

3.1.3.10 Migrate configured items through life cycle stages in strict accordance with change and quality control measures as defined in the Configuration Management Plan and ensure that duties are segregated between those with development responsibilities and those with production responsibilities,

3.1.3.11 Perform verification of production migrations.

3.1.3.12 Provide release information in CCM tickets for all migration releases to include high level description of what is planned for the release as soon as a target date has been established for a change.

3.1.3.13 Update CCM tickets when contents of a release changes due to schedule slippages or other requests per FSA prioritization.

3.1.3.14 Perform functional and physical configuration audits, and provide the results of those audits to the FSA Enterprise Configuration Management Team.

3.1.3.15 Maintain traceability of configuration items, including baselines and builds, to support all the functions of FSA’s Lifecycle Management Methodology.

3.1.4 Security and Audit Support

3.1.4.1 General

3.1.4.1.1 Comply with all applicable federal statutes, standards, and guidelines governing security (see requirements document for details.)

3.1.4.1.2 Ensure all Personally Identifiable Information (PII) is kept secure and provided only to properly authorized individuals and organizations.

3.1.4.1.3 Periodically assist with development the System Boundary Document through provision of information, and review the document

3.1.4.1.4 Participate in all required tasks related to obtaining/maintaining the Authority To Operate.

3.1.4.1.5 Monitor system access, maintain access authorizations and rules of behavior, and provide quarterly application access control reports to FSA.

3.1.4.1.6 Maintain NIST compliant risk controls and comply with ED policies and requirements for risk management, including compliance with all Secure Facilities requirements, Security Configuration, Security Personnel, and Security Telecommunications requirements

3.1.4.1.7 Contingency and Disaster Recovery Planning

3.1.4.1.8 Comply with federal regulations regarding personnel contingency training.

3.1.4.2 Incident Response

3.1.4.2.1 Develop and maintain an incident response plan that correlates to the Department of Education plan.

3.1.4.2.2 Monitor security incidents and report incidents in accordance with FSA security policy.

3.1.4.3 Audit Support and Government Oversight

3.1.4.3.1 Coordinate with FSA Communications team on performance of routine software scans for each release.

3.1.4.3.2 Provide focused support in responding to oversight agency audits and coordination with FSA Information System Security Officer (ISSO).

3.1.4.3.3 Provide timely and complete evidence to audit requests for information.

3.1.4.3.4 Capture and track all identified vulnerabilities, security weaknesses and corrective actions through FSA's Operational Vulnerability Management Solution (OVMS).

3.1.4.3.5 Provide input to development of Plans of Action and Milestones to FSA's Information System Security Officer (ISSO) for system audits, and shall remediate audit findings specified in those plans according to agreed-upon deadlines. Consistently assess the EDESuite application for security issues.

3.1.4.3.6 Contractor shall make themselves and their site(s) available for security audits and control assessments. This includes interviews with key security staff, data gathering and submissions, scanning support, and escort activities.

3.1.4.3.7 Provide monthly security reports to ISSO.

3.2 Customer Service

Customers and EDESuite users include schools, third party servicers, FSA staff and contractors. EDESuite users require a central source for resolving software issues that impede the awarding of financial aid to students. The services the Contractor shall provide are as follows: Provide helpdesk support and track customer service to EDESuite users under a service level agreement.

3.2.1 Provide support with professionals who have experience with higher education financial aid. Additionally, research of technical issues sometimes requires the use of NSLDS database, CPS online, and other tools.

3.2.2 Provide assistance to customers on topics including (but not limited to): download, installation, and setup of the software, basic info on sign-Up and access processes for interfacing systems, software functionality, batch file processing, which includes user reports/queries, exports and imports and updating records, data Transmissions and errors, documentation questions, software performance issues, security-related issues, basic Microsoft Office support (for tools/templates based in MS Office products that EDESuite provides its users).

3.2.3 Provide customer support services to Spanish-speaking customers.

3.2.4 Provide access to Foreign Schools to contact customer support in the same manner as the continental United States customers (e.g. if customers are unable to call an 800 number from abroad, there should be a backup “local” number available).

3.2.5 8:00 am to 8:00pm Eastern Standard Time Monday – Friday are the hours of availability for customer support. Not available on federal holidays.

3.2.6 Provide training for FSA staff and school customers on EDESuite uses and capabilities in PC labs and during sessions at FSA conferences. Currently, there is one FSA Training Conference per year.

3.2.7 In order to maintain high level of service to callers, provide “warm hand-off” of callers to other FSA customer service centers (e.g. COD Customer Service, CPS Customer Service, etc.) when other organizations are needed to resolve a caller’s question or issue.

3.2.8 Prepare user documentation, external communication materials and provide associated customer service, and

3.2.9 Provide tracking and reporting of customer service metrics (e.g. calls and emails received/answered/missed, software downloads, problem tickets opened, etc.).

3.3 Project Management and Quality Control

3.3.1 The Contractor shall perform the work described in this section in support of each of the specific requirements for the EDESuite contract as described in this SOO and attached requirements documents, and in accordance with the terms and conditions of this contract. This section describes the contract requirements for Project Management and Quality Control. Additionally, this section contains a brief description of the general project management approach. The Contractor shall:

3.3.1.1 Follow industry best practices and methodologies for project management.

3.3.1.2 Develop a transition plan describing timeline, key tasks, and meetings to be completed as part of the vendor transition process.

3.3.1.3 The Contractor project manager, designated as Key Personnel, shall be PMI Project Management Professional (PMP) certified or equivalent.

3.3.1.4 Key personnel employed by the EDESuite contractor shall possess significant experience in maintaining and updating system code using Microsoft Visual C#.

3.3.1.5 Key personnel employed by the EDESuite contractor shall possess significant knowledge of Title IV programs and data.

3.3.1.6 The Contractor shall follow FSA Lifecycle Management Methodology (LMM) for management of the software development lifecycle, or shall propose an alternative model and describe how it maps to FSA’s LMM process and requirements.

3.3.1.7 Institute and maintain an effective, efficient, and responsive management organization that shall oversee all Contractor personnel and subcontractor resources used in the performance of this Contract. The Contractor shall be responsible for ensuring that all tasks and work activities are performed in a timely and cost-effective manner, while maintaining the highest quality of performance.

3.3.1.8 Incorporate the appropriate plans, phases, activities, products, and stage gate reviews into its project plan for this Contract. The Contractor shall incorporate only those components that are relevant to the size, scope, and complexity of the activities for this Contract.

3.3.1.8.1 Stage gates are predetermined technical and management reviews that will be conducted during the course of development projects to ensure that the results of the various tasks and activities are acceptable to all project participants and that the project should proceed.

3.3.1.9 The Contractor shall identify and maintain a management structure and organization with overall control and authority for the performance of work under this contract. The Contractor's management structure and organization shall be capable of ensuring, at a minimum, that the following functional and personnel requirements are met:

3.3.1.9.1 A technically proficient and professionally capable staff is established and maintained throughout the life of the contract.

3.3.1.9.2 Personnel turnover is minimized and individuals are motivated to achieve excellent performance throughout the life of the contract.

3.3.1.9.3 Seamless phase-in of contractor personnel without interruption.

3.3.1.9.4 Effective management of contractor personnel to ensure an adequate level of staffing at all times.

3.3.1.10 Consistent and accurate reporting of performance to the Government.

3.3.1.11 Problems are resolved with minimal disruption to the activities being performed under the contract.

3.3.1.12 All resources used for performance of work under the contract are identified and their roles are clearly defined and communicated.

3.3.1.13 Process improvements are made on a continuous basis in an effort to improve both the timeliness and quality of work products.

3.3.1.14 Ensure risks are identified, assessed, and mitigated on a continual basis.

3.3.1.15 Ensure all contractual requirements are met.

3.3.1.16 Implementation and management of subcontractor(s) is adequate and fosters continuity of operations.

3.3.1.17 Quality management is in accordance with the Contractor’s Quality Control and Performance Management plans.

3.3.1.18 The Government may conduct other technical stage gates with the Contractor during the course of the Contract as appropriate.

4 Government’s Quality Assurance and Surveillance Methods

The surveillance methods listed below shall be used in the administration of the Government’s quality assurance and surveillance process:

4.1 Periodic Reviews

Performance Management Reviews (PMRs) will be conducted on a recurring basis. The three objectives of the PMRs are as follows:

4.1.1 Monitor the Contractor’s performance to ensure compliance with the performance requirements set forth in this contract,

4.1.2 Ensure an open communication channel between FSA and Contractor, and

4.1.3 Identify and resolve potential issues that may impact the level of performance in the services required (i.e. risk management).

4.2 Monitoring

Random and scheduled monitoring will be conducted to:

4.2.1 Ensure compliance with contract requirements for those areas in which the Government determines a need exists, and

4.2.2 Obtain data to support the performance measures.

4.2.3 Other methods of quality assurance may be added by the Government in the future as needed. Monitoring can be performed randomly, periodically, and/or through surveillance.

5 Deliverables

FSA encourages collaboration during the deliverable development phase whereby early drafts are delivered for review and comment. Utilizing this concept, FSA would review the draft deliverable and provide comments to the contractor according to the schedule in the attached List of Contract Deliverables. All deliverables shall be developed in accordance with FSA’s LMM provided templates (except where variances are agreed to by contractor and FSA), and agreed upon with FSA personnel where tailoring or alteration is applicable.

The Contractor shall provide the deliverables identified in the attached Deliverable Table in accordance with the schedule approved by the Government. The Contractor may be required to provide additional deliverables either upon Government request or as proposed in the Contractor. In addition, the Contractor shall update deliverables throughout the life of the contract as necessary or as directed.

The standards established within the FSA templates are a guide by which contractor work products will be validated for alignment with FSA’s enterprise architecture standards and envisioned technical architecture. The Contractor shall utilize the latest version for each deliverable as appropriate and agreed upon with FSA personnel.

5.1 Deliverable Requirements

5.1.1 All deliverables shall be submitted electronically, be aligned to FSA’s Lifecycle Management Methodology (LMM) standards (except where variances are agreed to by contractor and FSA), and in their native and editable forms, such as Microsoft Office tool formats: Word, Excel, Visio, PowerPoint or Project.

5.1.2 The source files for any artwork present in any document are to be delivered in an editable or native format (such as Microsoft Visio or Adobe Illustrator).

5.1.3 Textual / tabular requirements shall also be submitted electronically in an editable form.

5.1.4 Any final data models created as part of development efforts shall be submitted electronically in a form that is capable of import into FSA’s enterprise standard data modeling tool (currently Embarcadero ER/Studio.)

5.1.5 All sequencing plans and project schedules shall be submitted electronically in a form that may be used by Microsoft Project.

5.1.6 All source code shall be delivered in a format appropriate for the implementation language (e.g., C#, Java, XML, BPEL, SQL DDL, SQL DML, ETL tool-specific language, HTML, Perl, UNIX shells script). All source code comprising an executable shall be delivered along with supporting scripts or the equivalent necessary to build, deploy and operate the executable system on the required hardware.

5.2 Deliverable Schedule

· Delivery Minimum (DM)

* 5 work days for FSA to review and comment

* 3 work days for Contractor to respond with updates

* 2 work days for FSA to accept/reject updates

· Delivery Standard (DS)

* 10 work days for FSA to review and comment

* 5 work days for Contractor to respond with updates

* 5 work days for FSA to accept/reject updates

· Delivery Extended (DE)

* 15 work days for FSA to review and comment

* 7 work days for Contractor to respond with updates

* 7 work days for FSA to accept/reject updates

· Delivery Extra (DX)

* 20 work days for FSA to review and comment

* 10 work days for Contractor to respond with updates

* 10 work days for FSA to accept/reject updates 6 Constraints and Assumptions

6.1 Statutes

The following non-all-inclusive list of applicable statutes governing this program is provided for informational purposes:

HEA 1965, as amended

Privacy Act of 1974 (PL93-502)

Freedom of Information Act of 1974 (PL 93-502)

Federal Managers’ Financial Integrity Act of 1983 (PL 97-255)

Computer Fraud and Abuse Act of 1986 (PL 99-474)

Computer Security Act of 1987 (PL 100-235)

E-Government Act 2002

Federal Information Security Management Act (FISMA) 2002

Higher Education Reconciliation Act (HERA) 2005

College Cost Reduction and Access Act 2007 (CCRAA)

Higher Education Opportunity Act (HEOA) 2008

Ensuring Continued Access to Student Loans Act 2008 (ECASLA)

Health Care and Education Reconciliation Act 2010 (HCERA)

Consolidated Appropriations Act 2012

MAP-21 (2012) (Public Law 112-141)

OMB Circular A-123

Sections 504 and 508 of the Rehabilitation Act of 1973

6.2 FSA’s Lifecycle Management and CMMI Level 3

6.2.1 The Contractor shall follow FSA - Lifecycle Management Methodology (LMM) (except where agreement is reached between FSA and contractor), and shall adhere to the Project Management Institute (PMI), and Capability Maturity Model Integration (CMMI) methodologies. The Contractor shall follow CMMI Level 3 equivalent procedures or higher and shall produce CMMI Level 3 equivalent documentation throughout the life of the contract.

6.2.2 Provide a Contractor Project Management Plan (see LMM) as part of the Project Management Plan to include the activities outlined in this section as well as any other activities deemed necessary to provide the best value to the Government, manage the requirements of this Contract, and address the constraints identified in Section 6 in this SOO. The Contractor shall coordinate its activities with Systems Integration Division staff as required.

6.2.3 Institute and maintain an effective, efficient, and responsive management organization that shall oversee all Contractor personnel and subcontractor resources used in the performance of this Contract. The Contractor shall be responsible for ensuring that all tasks and work activities are performed in a timely and cost-effective manner, while maintaining the highest quality of performance.

6.2.4 Incorporate the appropriate plans, stages, activities, products, and stage gate reviews into its project plan for this contract. The Contractor shall incorporate only those components that are relevant to the size, scope, and complexity of the activities for this contract.

6.3 Department/FSA Directives and Standards

This section identifies several of FSA’s infrastructure standards that must be adhered to by vendors. This list is a sample list and is not all-inclusive.

· Applicable IT and security standards, including:

· National Institute of Standards and Technology (NIST) security standards

· Federal Information Processing Standards (FIPS)

· US Department of Education OCIO-01, Handbook for Information Assurance Security Policy (2005)

· Information Technology Security Certification and Accreditation Procedures (OCIO-05)

· Information Technology Security Configuration Management Planning Procedures (OCIO-11)

· Information Security Incident Response and Reporting Procedures (OCIO-14)

· Protection of Sensitive But Unclassified Information (OCIO-15)

· Contractor Employee Personnel Security Screenings (OM: 5-101)

· OMB Circular A-130

· IRS 1075

· Contractor Employee Personnel Security Screening Policy Supplement

· Sections 504 and 508 of the Rehabilitation Act of 1973

· Business Operations Change Management (CM) – The Business Operations Change Management (CM) process is used to manage change requests (CRs) to hardware and software on all FSA Business Operations Division systems (EDESuite included). CRs are coordinated by the Business Operations Change Management Division, and are stored on a Rational ClearQuest tracking system. Detailed documentation on the CM process, along with contractor responsibilities is available upon request.

· Enterprise Change Management (ECM) - The Enterprise Change Management (ECM) process is used to manage Enterprise Change Requests (ECRs) that impact any non- FSA Business Operations Division systems (e.g. PEPS, AIMS, etc.) or FSA Virtual Data Center (VDC) resources. Project teams, FSA Enterprise level groups or the VDC itself can submit ECRs. The tracking of the CR process is automated through the use of Rational ClearQuest, which was the application selected and customized to manage FSA’s Enterprise Change Management process. Additional documentation on the ECM process is available upon request.

· Application programming language: Currently Microsoft Visual C# (this standard open to change pending agreed-upon modernization proposal [see Objective 2.5]).

6.4 Vendor Transition

The EDESuite Maintenance, Support, and Operations vendor shall provide FSA with an initial high level draft of a transition work/project plan as part of the proposal. The awardee will operate in parallel with the current contractor as necessary to ensure that all EDESuite Maintenance, Support, and Operations functions are fully transitioned in accordance with a pre-defined and approved transition work/project plan. All contractor parties must ensure that no business disruption occurs during the transition of responsibilities process. Great care is needed to make the transition as seamless as possible for EDESuite customers.

6.5 EDESuite Maintenance, Support, and Operations Work Effort Assumptions

6.5.1 Work efforts will include updates to all impacted user documentation and helptext concurrent with the deployment of the associated software update.

6.5.2 Work efforts will adhere to FSA’s enterprise standards (see Reference Material section) and will support the objectives defined in the previous sections.

6.5.3 The vendor will be responsible for the complete and thorough testing of all EDESuite software developments efforts according to FSA standards and quality control best practices (see Reference Material section) prior to deployment into production environment. Testing will include (but not be limited to) system, user acceptance, 508, and inter-system testing. Maintenance fixes should be deployed in accordance with FSA standards.

6.5.4 Work efforts will be required to interface, both directly and indirectly, with the existing FSA Integrated Technical Environment. This technical environment includes multiple internal system interfaces.

7 System Interfaces

Below are listed all major interfaces with the EDESuite. For additional information on interfaces, please refer to the High Level Requirements document, Interfaces section for details.

Internal

· Common Origination and Disbursement system (COD)

· Central Processing System (CPS)

· FAA Access to CPS Online 8 Government Furnished Property

· EDESuite application system software

9 Period of Performance

The period of performance is one-year and will commence on the award date (approx. May 1 2022). The Contract will have one (1) base year, plus four one-year options not to exceed five (5) years total after contract award.

10 Place of Performance

The work specified shall be performed at the Contractor's facility. Access to personnel and systems needed to conduct the activities of this task will be provided at the U.S. Government's facility in Washington, D.C. No office space will be provided at the U.S. Government facility.

The Contractor shall normally work the same days as FSA staff unless approved by FSA, maintain office phone coverage from 8:00 a.m. to 5:00 p.m. Eastern (Customer Service hours are 8:00 am to 8:00pm Eastern Monday to Friday), and be available for routine meetings during normal Department working hours (8:00 a.m. - 5:00 p.m. Monday - Friday). In addition, the Contractor will be required to be available seven days per week, 24 hours a day to provide support for urgent/emergency trouble calls. This support may be via mobile phone at the Contractor’s expense. All other required work will take place at contractor facilities.

11 Appendix A: Performance Requirements

The Contractor shall provide services to meet the performance requirements of this task order. To measure achievement of the functional objectives defined in the SOO, Section 2, the Contractor shall propose performance metrics as part of the Contractor’s proposal. A complete set of contract performance metrics shall be defined as part of the Performance Work Statement (PWS), as developed by the Contractor and approved by the Government.

The Performance Metric table below identifies:

· Performance Category: Key result areas that reflect the Contractor’s set of responsibilities.

· Performance Objective: Key outcomes and goals that the Contractor’s efforts will affect.

· Acceptable Quality Level: Minimum level of satisfactory performance.

· Method of Surveillance:

· Sampling: Appropriate for frequently recurring tasks. Evaluate randomly selected samples of the lot to determine the acceptability of the entire lot.

· 100 Percent Inspection: Appropriate for tasks that occur infrequently. Inspect and evaluate performance each time task is performed

· Periodic Surveillance: Evaluation of samples selected on other than 100% or statistically…