Attachment_1_NSLDS_Statement_Of_Objectives.pdf

Department of Education Federal Student Aid (FSA)

Attachment 1

Statement of Objectives (SOO)

NATIONAL STUDENT LOAN DATA SYSTEM (NSLDS)

Phase 1

February 4, 2014 i

Table of Contents

1 NSLDS OVERVIEW

2 OBJECTIVES

2.1 DATA COLLECTION AND DATA QUALITY

2.2 BUSINESS OPERATIONS AND PRODUCTION SUPPORT

2.3 TRAINING

2.4 NSLDS SYSTEM CHANGE

2.5 NSLDS DATABASE SECURITY

2.6 CUSTOMER ASSISTANCE

2.7 TRANSITION SUPPORT

2.8 AUDIT SUPPORT

2.9 OPTIONAL ENHANCEMENTS

2.10 OPTIONAL HOSTING

3 SCOPE OF WORK

3.1 SYSTEM ENHANCEMENTS, OPERATIONS & MAINTENANCE, CONFIGURATION

MANAGEMENT, AND AUDIT SUPPORT

3.2 BUSINESS SERVICE OPERATIONS SUPPORT

3.3 CUSTOMER SERVICE

3.4 PROJECT MANAGEMENT AND QUALITY CONTROL

3.5 OPTION: HOSTING CAPABILITY

4 GOVERNMENT’S QUALITY ASSURANCE AND SURVEILLANCE

METHODS

4.1 PERIODIC REVIEWS

4.2 MONITORING

5 DELIVERABLES

5.1 DELIVERABLE REQUIREMENTS

5.2 DELIVERABLE SCHEDULE

6 CONSTRAINTS

6.1 STATUTES

6.2 FSA’S LIFECYCLE MANAGEMENT

6.3 DEPARTMENT/FSA DIRECTIVES AND STANDARDS

6.4 VENDOR TRANSITION

6.5 NSLDS MAINTENANCE, SUPPORT, AND OPERATIONS WORK EFFORT

ASSUMPTIONS

6.6 SYSTEM INTERFACES

12 APPENDIX A: ACRONYMS

PURPOSE

The outcome of the procurement will be a five year (1 year base plus 4 option years) Operations and Maintenance contract to begin July 1, 2014, for the continuing operation, support, and maintenance of the Department of Education’s National Student Loan Data System (NSLDS).

1 NSLDS OVERVIEW

The National Student Loan Data System (NSLDS) is a comprehensive and centralized repository of information for federal student aid recipients and their loans, Pell grants, Lenders, guaranty agencies, Servicers and Schools and is authorized by the Higher Education Act of 1965, as amended by the Amendments of 1986, 1992, 1995, 1998, 2003, and 2008. NSLDS provides an integrated view of Title IV loans and grants during all stages of their life cycle—from aid approval through disbursement, repayment, default, and closure. The three main goals of the NSLDS are to:

1. Improve the quality and accessibility of student financial aid data.

2. Reduce the administrative burden of Title IV aid.

3. Minimize abuse within aid programs by accurately tracking funds awarded to assist postsecondary students.

The system itself is composed of a mainframe-hosted database and two associated websites (one for Student Access; one for Financial Aid Professionals). Select users can interact with the database directly via mainframe. A much broader group of users though interacts with the database via batch file exchanges or via the two websites in order to either report Title IV financial aid data to NSLDS or request Title IV data.

Incoming data is supplied to NSLDS from many different sources, both from other FSA systems and from thousands of schools and financial institutions across the country. The data arrives in a variety of formats and according to schedules set for each reporting organization. Output from NSLDS is determined by business functionality, and includes but is not limited to, web data displays, letters, and batch files (reports, confirmations, error files) which are provided in a variety of electronic formats.

As of January 2013, the NSLDS contains more than 25.9 billion active and historic records concerning 81,058,371 Students, 363,119,792 Loans, 113,132,266 Federal Grants, 46,917 School Locations, 19,438 Schools, 31,784 Lenders, and 81 Guaranty Agencies, with annual growth expected at 20 million loans, 7 million grants, and 3 million borrowers..

The contract resulting from this procurement will establish a performance-based business arrangement with the contractor for efficient, effective, and responsive support of the NSLDS system, including collaboration with the current contractor during the transition of all duties from the old Operations and Maintenance contract to the new. It is critical that FSA’s programs deliver world-class customer service during the transition at the lowest cost without sacrificing service levels or quality and without disruption or degradation of services.

The execution of this contract will provide support to NSLDS for several key objectives.

Specifically, the contractor will be responsible for 1) Data Collection, Data Quality, and Ease of Access, 2) Business Operations and Production Support, 3) Training, 4) NSLDS System Changes, 5) NSLDS Database Security, 6) Customer Assistance, 7) Transition Support, and 8) Audit Support. The contract may also potentially include (depending on contractor responses) 9) additional work to incrementally improve the efficiency and functionality of NSLDS and its websites, and 10) system hosting responsibilities.

2 OBJECTIVES

2.1 Data Collection and Data Quality

Collect data and maintain a centralized, comprehensive database of Title IV student financial aid and its recipients. The contractor shall undertake efforts to maximize the quality, integrity, and timeliness of NSLDS data in order to ensure a high-level of customer confidence. The contractor shall also ensure ease of access to the database for all authorized NSLDS users.

2.2 Business Operations and Production Support

Maintain, support, and operate the NSLDS system and associated websites to support the primary business functions of NSLDS. Maintenance support and operations should be performed with emphasis on excellent customer service, best practices, and measurements of performance.

2.3 Training

Maintain and update training materials and training presentations as necessary to ensure that all authorized NSLDS users understand the functions and data of the system and its associated websites.

2.4 NSLDS System Change

Participate in the FSA Enterprise and Business Operations change management process.

Assist FSA in defining requirements and implementing enhancements to keep pace with changes in legislation, policy, business and technology requirements.

2.5 NSLDS Database Security

Ensure that access to the database is secure and granted only to authorized users. Abide by all applicable federal and FSA rules governing (but not limited to) system access and protection of personally identifiable data.

2.6 Customer Assistance

Customer Assistance involves providing full service help to all NSLDS customers and authorized users. NSLDS customers and users include schools, students, guaranty agencies, lenders, ED servicers, FSA staff, FSA contractors, state agencies, and third party servicers. Users require technical assistance with all the required business services provided by NSLDS. Assistance topics include: website security; navigation of the website; updating data on the database; basic Microsoft Office support (for tools/templates based in MS Office products that NSLDS provides its users); batch processing, which includes enrollment reporting, student transfer monitoring, data provider submittals, financial aid history requests, user reports/queries; and production control. NSLDS customers require a central source for resolving and negotiating data conflicts that impede the awarding of financial aid to students.

Responding to the users requesting technical assistance as described above needs support from professionals with higher education financial aid experience. Additionally, research of these technical issues requires use of the NSLDS database and tools.

International customers need to be able to contact NSLDS in the same manner as the continental United States customers. NSLDS is also required to provide customer help services to Spanish-speaking customers. The hours of availability for customer help need to reflect customer needs across United States time zones.

Additional customer help includes providing formal training for ED staff on NSLDS, its functions and uses--in particular, how to query the database--as well as providing informal training for NSLDS customers in PC labs and sessions at various student financial aid conferences.

Customer help also includes preparation of user documentation and assistance with interpreting the documentation.

2.7 Transition Support

Partner with the current NSLDS contractor to transition all O&M duties, system access, documentation, and current NSLDS system functionality over a three-month period after the contract is awarded. Contractor shall provide FSA with a transition plan, and shall support a transition that is transparent to system users, data providers and data consumers. Provide development support for the mainframe and (2) associated websites to facilitate the transition.

Contractors should be prepared, starting with the first contract option year, to support a possible migration of the NSLDS from its current hosting solution (the Virtual Data Center) to one hosted by them or one of their subcontractors. In the event FSA decides to exercise this alternative hosting arrangement, sufficient lead time will be provided to the contractor to develop a hosting transition plan, data migration plan, and secure the appropriate staff and hardware/software resources.

2.8 Audit Support

Provide support to the FSA Security Division in managing interactions with auditors reviewing the NSLDS application for A-123, Financial Statement, Inspector General (IG), Government Accountability Office (GAO), and other audits that may be conducted of NSLDS. Support includes responding to audit inquiries, providing evidence for findings, remediation plans for findings, and executing remediation plans within required deadlines of the Corrective Action Plans (CAP).

2.9 Optional Enhancements

Improve the efficiency and functionality of the NSLDS and its websites.

2.10 Optional Hosting

Provide hardware, support software, and hosting services for the NSLDS and its associated websites.

3 SCOPE OF WORK

Identified in this section is the scope of work necessary to maintain and support NSLDS and its business functions effectively and efficiently. The scope of work is comprised of the following major components.

3.1 System Enhancements, Operations & Maintenance, Configuration Management, and Audit Support

The Contractor shall provide technical support to maintain the operation of NSLDS business functionality and the database while completing system enhancements. It also provides the technical support to track and resolve software and operational issues.

Finally, this area of scope specifies the work with the Virtual Data Center (VDC) to manage the configuration of NSLDS software and hardware assets, as well as the work with Information System Security Officer (ISSO) on security compliance and audit support. The Contractor shall provide the following services:

System Enhancements 3.1.1 The Contractor shall provide the capability to enhance the NSLDS system on a monthly basis following mature, sound processes to ensure predictable outcomes by effectively managing the scope, schedule and effort on agreed upon change requests.

The scope of NSLDS System Enhancements requires that the contractor:

Define and implement enhancements to keep pace with changes in 3.1.1.1 legislation, policy, business and technology requirements.

Define and implement enhancements to maintain proper interfaces with 3.1.1.2 internal and external systems and technical infrastructure components.

Manage functional requirement changes. 3.1.1.3

Determine a monthly release schedule for each year with a proposed level 3.1.1.4 of requirements changes that can be accommodated.

Work through Federal Student Aid’s Business Operations and Enterprise 3.1.1.5 Change Management processes to implement new requirements

Effectively manage change requests from FSA providing ROMs, 3.1.1.6 proposals, alternative solutions, etc as requested in the change request within allotted time periods.

Provide thorough project management support ensuring control of scope, 3.1.1.7 schedule and effort, and performing analysis on development, maintenance, and enhancement projects, conducting regular status meetings as agreed upon with FSA for change, Provide thorough impact assessment for change requests to assure 3.1.1.8 effective implementations of change requests occur without unintended consequences to other NSLDS applications components and external parties.

Define detailed requirements ensuring specificity of customer 3.1.1.9 requirements are appropriately detailed and traceable throughout development lifecycle.

Provide detailed design artifacts that appropriately describe, chart, and 3.1.1.10 illustrate the design approach that fully meets detailed requirements.

Perform comprehensive approach to testing application changes to 3.1.1.11 include planning, scripting, requirements traceability, reporting results and risk mitigation and effectively communicate to FSA.

Create a robust testing dataset with sufficient test data to conduct all 3.1.1.12 phases of testing completely.

Perform system testing, 508 compliance testing, and user acceptance 3.1.1.13 testing in accordance with best practices. Maintain separate testing environments as necessary to ensure testing efforts are not delayed nor their results contaminated due to concurrent testing efforts (e.g. being unable to conduct UAT due to performance or system testing efforts currently underway on one environment).

Provide a testing facility and all necessary equipment and data 3.1.1.14 connections for use by Federal Student Aid user acceptance testers.

Support independent performance testing of solutions by providing data, 3.1.1.15 scenarios, volumes, support of performance testing activities, and capacity estimates, including trending of performance data. In the absence of independent performance testing, the contractor shall conduct performance testing of their responsible areas.

Conduct and support intersystem testing between NSLDS and other 3.1.1.16 trading partners, both inside and outside of Federal Student Aid. The contractor shall provide resources, interface control documents, test data, and test cases/scenarios in support of intersystem testing.

Code and unit test application changes as articulated in the detailed 3.1.1.17 design to ensure requirements are met.

Conduct implementation planning and execution: 3.1.1.18

Provide thorough approach to communicating changes to the NSLDS 3.1.1.18.1 through Newsletters, Web messages, updated user guides/layouts, training/conference materials, collaboration with Federal Student Aid Communications, etc., as appropriate to the change.

Conduct effective controls of development environments to include 3.1.1.18.2 development, user acceptance, production and training through Test Readiness Review and Production Readiness Review processes and procedures and provide materials to FSA.

Monitor first live batch to ensure application codes changes are 3.1.1.18.3 working properly and that there isn’t residual degradation to application.

Provide post production support per FSA agreed period. 3.1.1.18.4

Ensure compliance with sections 504 and 508 of the U.S. Rehabilitation 3.1.1.19 Act.

Operations and Maintenance Support 3.1.2

Provide technical resources to keep the system (the database and associated 3.1.3 websites) working efficiently and effectively.

Ensure continued availability of all NSLDS business functions (See Current 3.1.4 State Analysis and High Level Requirements documents for current functions).

Provide new and/or update existing documentation (e.g. User Documentation 3.1.5 and Notifications, Functional Requirements, Functional Specifications, and

Detail Design Specifications) to reflect any change to software, processes, and procedures.

Provide 24 X 7 support to application/system production problems. 3.1.6

Provide database administration. 3.1.7

Provide continuous security monitoring of the NSLDS to maintain a 3.1.8 continuous security authorization.

Provide application software maintenance (e.g. software fixes) and meet 3.1.9 established timelines per Configuration Control Board (CCB) approval and priority setting.

Perform unit testing. 3.1.10

Perform validation of programming for both results and performance. 3.1.11

Ensure all system, application, and procedural documentation is complete, 3.1.12 updated, and accurate.

Provide monthly CCB and maintenance progress reports to FSA. 3.1.13

The contractor shall participate in capacity planning and evergreening 3.1.14 activities.

Evergreening Support will include planning and scheduling, impact 3.1.14.1 analysis, code changes, coordination, communication, and testing activities.

Produce quarterly capacity planning reports which holistically evaluate 3.1.14.2 requirements and trends for NSLDS information resources in order to produce a forecast and recommendations with specific sizes, quantities, types and timing.

Collaboratively and actively participate in capacity reviews and provide 3.1.14.3 information to support usage of current capacity and forecasting for infrastructure resources for current and new systems to meet Federal Student Aid’s business needs.

Implement hardware and software upgrades and patches to ensure that the 3.1.14.4 solution evolves along with FSA’s enterprise standards and industry best practices.

Develop capability for continuous monitoring of application and database 3.1.15 performance to support day to day business processing requirements, and provide the ability to assess performance impacts for major system enhancements. Capability includes:

Ensure that the overall peak demand for MIPS for NSLDS is monitored 3.1.15.1 and that changes to the application and increasing application volumes are adequately measured. Ensure that this information is input to planning and support activities of the NSLDS environment.

Monitor and measure changes to the NSLDS application and application 3.1.15.2 volumes to ensure batch run times are not being elongated, causing performance to degrade and business processes to be impacted for equivalent volumes.

Measure changes to the NSLDS online application and ensure the 3.1.15.3 increasing volume of online transactions is not causing the degradation in the customer experience, as measured by online response times, performance under load, etc.

Work with FSA to baseline and report monthly an overall application 3.1.15.4 performance profile to include mainframe and web components, storage capacity, query monitoring and optimization.

The contractor shall produce written capacity management reports at 3.1.15.5 periodic intervals, as agreed to by the Department, which summarize actions taken since the last report as well as prescriptive recommendations which minimize cost and maximize efficiency.

"Provide guidance and coordinate with the VDC and FSA production liaison in 3.1.16 the following areas:

Support the VDC’s creation of backups of data received or generated by 3.1.16.1 the NSLDS application (set by Contractor via JCL and program level allocations) - Assist FSA-NSLDS production backups Sunday night to Thursday night database image copies (tablespaces only) – set by Contractor to 14 days.

Assist FSA and VDC in setting in FDR Archive Control Jobs as 3.1.16.2 determined by Contractor and implemented by the VDC (30 years rule may apply…for example Cohort default rate).

Provide daily Abend report to FSA explaining the root cause and the user 3.1.16.3 (SME) affected by the job.

Provide advance notice/guidance to FSA Operations staff (FSA 3.1.16.4 Production liaison) for potential Database growth (eg.,total number of rows) for DASD management, monitor large batch jobs and interface jobs for external users/partners.

Monitor performance of the NSLDS application and provide pro-active 3.1.16.5 “heads-up” to the FSA production Liaison in cases of outage and/or significant system degradation.

Monitor resource allocation: CPU, MIPS, DB2 Table size/Table space. 3.1.16.6

NSLDS contractor personnel must attend all critical NSLDS production 3.1.17 meetings and communicate any pertinent information through emails, phone calls to the FSA production liaison.

Capture database statistics and provide them on a regular interval/frequency. 3.1.18

Participate in disaster recovery test execution by testing recovered application 3.1.19 software, and fully document recovery test scripts.

Comply with the Federal Student Aid Software License Management process. 3.1.20 Refer to the Technology Office Infrastructure Operations Group Concept of Operations for additional information.

https://fsa.share.ed.gov/TOSL/PBLSH/TOIOGConOps.pdf

Change Management and Configuration Management Support 3.1.21 Change Management

Adhere to FSA's Enterprise Change Management and Business 3.1.21.1 Operations Change Management processes to implement new requirements.

For each change control received, provide thorough impact assessment 3.1.21.2 for change requests including understanding of the high-level requirements, contractor assumptions and risks, an estimated implementation date/schedule, feasibility, and an assessment of all impacts to interfacing systems/services, both internal/external to FSA.

Obtain Federal Student Aid approval of system changes prior to 3.1.21.3 production implementation.

Configuration Management

Document baseline configurations and establish policy, procedures, 3.1.21.4 guidelines, and accountability for modification of baseline configurations through creation and maintenance of a Configuration Management Plan.

Establish a configuration control board, with oversight responsibility for configuration change management.

Monitor and ensure configuration settings compliance with all applicable 3.1.21.5 federal IT security policies and regulations.

Manage application software changes. 3.1.21.6

Control configured application components. 3.1.21.7

Provide inventory control of government items. 3.1.21.8

Migrate configured items through life cycle stages in strict accordance 3.1.21.9 with change and quality control measures as defined in the Configuration Management Plan and ensure that duties are segregated between those with development responsibilities and those with production responsibilities, Perform verification of production status migrations. 3.1.21.10

Provide an hour-by-hour plan for all production migration releases 5 3.1.21.11 business days prior to planned deployment to production.

Provide release information in CCM tickets for all migration releases to 3.1.21.12 include high level description of what is planned for the release as soon as a target date has been established for a change.

Update CCM tickets when contents of a release changes due to schedule 3.1.21.13 slippages or other requests per FSA prioritization.

Conduct an initial review of the NSLDS database structure upon contract 3.1.21.14 inception, provide an initial copy of the database schema in Embarcadero, and support any future updates to the schema using the FSA enterprise standard schema modeling tool.

Conduct an initial review of the NSLDS programming upon contract 3.1.21.15 inception, and create a deliverable document that maps NSLDS mainframe data processing jobs to NSLDS business processes.

Perform functional and physical configuration audits, and provide the 3.1.21.16 results of those audits to the FSA Enterprise Configuration Management Team.

Maintain traceability of configuration items, including baselines and 3.1.21.17 builds, to support all the functions of FSA’s Lifecycle Management Methodology.

Security and Audit Support 3.1.22

General 3.1.22.1

Comply with all applicable federal statutes, standards, and guidelines 3.1.22.1.1 governing security (see requirements document for details.)

Ensure all Personally Identifiable Information (PII) is kept secure and 3.1.22.1.2 provided only to properly authorized individuals and organizations.

Develop and periodically review the System Boundary Document. 3.1.22.1.3

Participate in all required tasks related to obtaining/maintaining the 3.1.22.1.4 Authority To Operate.

Monitor system access, maintain access authorizations and rules of 3.1.22.1.5 behavior, and provide quarterly application access control reports to

FSA.

Maintain NIST compliant risk controls and comply with ED policies 3.1.22.1.6 and requirements for risk management.

Comply with all Secure Facilities requirements. 3.1.22.1.7

Comply with all Security Configuration requirements. 3.1.22.1.8

Comply with all Security Personnel requirements. 3.1.22.1.9

Comply with all Security Telecommunications requirements. 3.1.22.1.10

Contingency and Disaster Recovery Planning 3.1.22.2

Develop and maintain the System Security Plan (SSP), IT 3.1.22.2.1 Contingency Plan, and Disaster Recovery Plan.

Participate in contingency testing and disaster recovery testingby 3.1.22.2.2 testing recovered application software, and fully document recovery test scripts.

Perform data sanitation at the recovery site after testing. 3.1.22.2.3

Comply with federal regulations regarding personnel contingency 3.1.22.2.4 training.

Incident Response 3.1.22.3

Develop and maintain an incident response plan that correlates to the 3.1.22.3.1 Department of Education plan.

Monitor security incidents and report incidents in accordance with 3.1.22.3.2 FSA security policy.

Audit Support and Government Oversight 3.1.22.4

Perform routine network, database, and web applications scans on a 3.1.22.4.1 quarterly basis. The scan results are analyzed and vulnerabilities identified.

Provide focused support in responding to oversight agency audits and 3.1.22.4.2 coordination with FSA Information System Security Officer (ISSO).

Provide timely and complete evidence to audit requests for 3.1.22.4.3 information.

Capture and track all identified vulnerabilities, security weaknesses 3.1.22.4.4 and corrective actions through Federal Student Aid's Operational Vulnerability Management Solution (OVMS).

Provide Plans of Action and Milestones to FSA's Information System 3.1.22.4.5 Security Officer (ISSO) for system audits, and shall remediate audit findings specified in those plans according to agreed-upon deadlines.

Consistently monitor the NSLDS application for security violations and suspicious activity.

Contractor shall make themselves and their site(s) available for 3.1.22.4.6 security audits and control assessments. This includes interviews with key security staff, data gathering and submissions, scanning support, and escort activities.

Provide monthly security reports to ISSO. 3.1.22.4.7

3.2 Business Service Operations Support

The Contractor shall provide FSA Business Operations with day-to-day business operational support that is necessary to keep the current NSLDS running at optimal service levels. Support in this area of scope will maintain and improve the quality of NSLDS data and continue to serve the areas of FSA’s business operations that are supported by NSLDS. The Operations Support responsibilities include:

Data Integrity 3.2.1

Develop and execute an NSLDS Data Quality Management Plan. 3.2.1.1

Assist data providers in correcting data errors and resolving data 3.2.1.2 conflicts.

Create a data quality team, and continuously inspect the NSLDS database 3.2.1.3 to proactively identify and correct errors and data inconsistencies and maintain a high-level of confidence in overall data quality.

Validate data – ensure compliance with statutory and regulatory 3.2.1.4 requirements.

Develop and issue data quality benchmark reports to data providers. 3.2.1.5

Develop and maintain the monthly NSLDS Data Quality Dashboard. 3.2.1.6

Perform monthly reviews of overall NSLDS data quality. 3.2.1.7

Maintain the quality of NSLDS data in order to ensure a high-level of 3.2.1.8 customer confidence.

Operations Support 3.2.2

Work with data providers and schools to resolve processing 3.2.2.1 problems/issues.

Provide expert subject matter assistance to FSA staff, data providers, 3.2.2.2 NSLDS users, and other government and non-government agencies and entities.

Monitor production schedules and problems with FSA’s Virtual Data 3.2.2.3 Center.

Coordinate and maintain production data provider schedules and 3.2.2.4 operations.

Provide training, training materials, presentations, conference support and 3.2.2.5 associated travel.

Support hardware and software upgrades, including application testing 3.2.2.6 during planned maintenance windows.

Comply with all FSA Records Management requirements (see 3.2.2.7 requirements document).

3.3 Customer Service

NSLDS customers and users include schools, guaranty agencies, lenders, ED servicers, FSA staff & contractors, state agencies and third party servicers. NSLDS customers require a central source for resolving and negotiating data conflicts that impede the awarding of financial aid to students. Please note: All Customer Service Center functions under this contract shall be severable, and should be priced as a separate line item within the proposal. The Customer Service Center will be exercised as an optional service and the Government reserves the right to not exercise the service.. The services the Contractor shall provide are as follows:.

Continue to provide and track customer service to existing NSLDS users under 3.3.1 service level agreements Coordinate helpdesk support between users and the NSLDS O&M Contractor.

Provide user support with professionals who have experience with higher 3.3.2 education financial aid. Additionally, research of technical issues requires the use of NSLDS database and tools.

Provide assistance to customers on topics including (but not limited to): 3.3.3 website security; navigation of the website; updating data on the database;

basic Microsoft Office support (for tools/templates based in MS Office products that NSLDS provides its users); batch processing, which includes enrollment reporting, student transfer monitoring, data provider submittals, financial aid history requests, user reports/queries; and production control.

Provide customer support services to Spanish-speaking customers. 3.3.4

Provide 800 number access to the helpdesk as well as a non-800 number line 3.3.5 for callers in locations without access to 800 numbers.

8:00 am to 9:00pm Eastern Standard Time are the hours of availability for 3.3.6 customer support.

Provide formal training for FSA staff on NSLDS, its functions, and uses, 3.3.7 including how to query the database. Provide training for NSLDS customers in PC labs and during sessions at FSA conferences. Currently, there are two FSA Conferences per year.

In order to maintain high level of service to callers, provide “warm hand-off” 3.3.8 of callers to other FSA customer service centers (e.g. COD Customer Service, various ED servicer customer centers, etc.) when other organizations are needed to resolve a caller’s question or issue.

Provide space for a designated ED or ED-authorized representative, to work 3.3.9 when on-site at the contractor’s office. The space shall include enclosed office space, a telephone, a computer(s) with access to Contractor’s systems, the Internet, and printer, fax and scanner access, administrative support and services, security, and senior Contractor management level parking. Transitory ED personnel shall be provided convenient parking and, if available, workspace.

Prepare user documentation, external communication materials and provide 3.3.10 associated customer service, and

Provide tracking and reporting regarding customer service metrics. 3.3.11

3.4 Project Management and Quality Control

The Contractor shall perform the work described in this section in support of 3.4.1 each of the specific requirements for the NSLDS contract as described in this SOO and attached requirements documents, and in accordance with the terms and conditions of this contract. This section describes the NSLDS contract requirements for Project Management and Quality Control. Additionally, this section contains a brief description of the general project management approach. The Contractor shall:

Follow industry best practices and methodologies for project 3.4.1.1 management.

Develop a transition plan describing timeline, key tasks, and meetings to 3.4.1.2 be completed as part of the transition process.

The Contractor project manager, designated as Key Personnel, shall be 3.4.1.3 PMI Project Management Professional (PMP) certified or equivalent.

Key personnel employed directly by the NSLDS prime contractor shall 3.4.1.4 possess significant experience in maintaining and updating system code using both COBOL and the CA:Gen/Cool:Gen/Advantage:Gen case tool.

Key personnel employed directly by the NSLDS prime contractor shall 3.4.1.5 possess significant experience in the operation and maintenance of DB2 and CICS mainframe environments.

The Contractor shall follow FSA Lifecycle Management Methodology 3.4.1.6 (LMM) for management of the software development lifecycle, or shall propose an alternative model and describe how it maps to FSA’s LMM process and requirements.

Institute and maintain an effective, efficient, and responsive management 3.4.1.7 organization that shall oversee all Contractor personnel and subcontractor resources used in the performance of this Contract. The Contractor shall be responsible for ensuring that all tasks and work activities are performed in a timely and cost-effective manner, while maintaining the highest quality of performance.

Incorporate the appropriate plans, phases, activities, products, and stage 3.4.1.8 gate reviews into its project plan for this Contract. The Contractor shall incorporate only those components that are relevant to the size, scope, and complexity of the activities for this Contract.

Stage gates are predetermined technical and management reviews that 3.4.1.8.1 will be conducted during the course of the project to ensure that the results of the various tasks and activities are acceptable to all project participants and that the project should proceed.

The Contractor shall identify and maintain a management structure and 3.4.1.9 organization with overall control and authority for the performance of work under this contract. The Contractor's management structure and organization shall be capable of ensuring, at a minimum, that the following functional and personnel requirements are met:

A technically proficient and professionally capable staff is established 3.4.1.9.1 and maintained throughout the life of the contract.

Personnel turnover is minimized and individuals are motivated to 3.4.1.9.2 achieve excellent performance throughout the life of the contract.

Seamless phase-in of contractor personnel without interruption. 3.4.1.9.3

Effective management of contractor personnel to ensure an adequate 3.4.1.9.4 level of staffing at all times.

Consistent and accurate reporting of performance to the Government. 3.4.1.10

Problems are resolved with minimal disruption to the activities being 3.4.1.11 performed under the contract.

All resources used for performance of work under the contract are 3.4.1.12 identified and their roles are clearly defined and communicated.

Process improvements are made on a continuous basis in an effort to 3.4.1.13 improve both the timeliness and quality of work products.

Risks are identified, assessed, and mitigated on a continual basis. 3.4.1.14

All contractual requirements are met. 3.4.1.15

Implementation and management of subcontractor(s) is adequate and 3.4.1.16 fosters continuity of operations.

Quality management is in accordance with the Contractor’s Quality 3.4.1.17 Control and Performance Management plans.

The Government may conduct other technical stage gates with the 3.4.1.18 Contractor during the course of the Contract as appropriate.

3.5 Option: Hosting Capability

FSA would like to explore vendor capacity to provide an alternative hosting environment to its current Virtual Data Center (VDC) environment. Vendors should include in their response to this SOO an analysis of their capability to do so, in addition to associated additional costs if asked to host. This expanded scope of work will include compliance with all requirements noted in the NSLDS High Level Requirements document, including sections for:

Operations and Maintenance (Additional Hosting Requirements) 3.5.1

System Enhancements (Additional Hosting Requirements) 3.5.2

Configuration Management (Additional Hosting Requirements) 3.5.3

Production Support (Additional Hosting Requirements including: ) 3.5.4

Monitoring 3.5.4.1

Incident management 3.5.4.2

Capacity planning and evergreening 3.5.4.3

Database backup and retention 3.5.4.4

Reports 3.5.4.5

Security (Additional Hosting Requirements including: ) 3.5.5

Monitoring and Prevention 3.5.5.1

Disaster Recovery 3.5.5.2

4 GOVERNMENT’S QUALITY ASSURANCE AND SURVEILLANCE

METHODS

The surveillance methods listed below shall be used in the administration of the Government’s quality assurance and surveillance process:

4.1 Periodic Reviews

Performance Management Reviews (PMRs) will be conducted on a recurring basis. The three objectives of the PMRs are as follows:

Monitor the Contractor’s performance to ensure compliance with the 4.1.1 performance requirements set forth in this contract, Ensure an open communication channel between FSA and Contractor, and 4.1.2

Identify and resolve potential issues that may impact the level of performance 4.1.3 in the services required (i.e. risk management).

4.2 Monitoring

Random and scheduled monitoring will be conducted to:

Ensure compliance with contract requirements for those areas in which the 4.2.1 Government determines a need exists, and

Obtain data to support the performance measures. 4.2.2

Other methods of quality assurance may be added by the Government in the 4.2.3 future as needed. Monitoring can be performed randomly, periodically, and/or through surveillance.

5 DELIVERABLES

FSA encourages collaboration during the deliverable development phase whereby early drafts are delivered for review and comment. Utilizing this concept, FSA would review the draft deliverable and provide comments to the contractor according to the schedule the will be provided in Phase 2. All deliverables shall be developed in accordance with FSA’s LMM provided templates (except where variances are agreed to by contractor and FSA), and agreed upon with FSA personnel where tailoring or alteration is applicable.

The Contractor shall provide the deliverables identified in Phase 2. The Contractor may be required to provide additional deliverables either upon Government request or as proposed in the Contractor. In addition, the Contractor shall update deliverables throughout the life of the contract as necessary or as directed.

The standards established within the FSA templates are a guide by which contractor work products will be validated for alignment with FSA’s enterprise architecture standards and envisioned technical architecture. The Contractor shall utilize the latest version for each deliverable as appropriate and agreed upon with FSA personnel.

5.1 Deliverable Requirements

All deliverables shall be submitted electronically, be aligned to FSA’s 5.1.1 Lifecycle Management Methodology (LMM) standards (except where variances are agreed to by contractor and FSA), and in their native and editable forms, such as Microsoft Office tool formats: Word, Excel, Visio, PowerPoint or Project.

The source files for any artwork present in any document are to be delivered in 5.1.2 an editable or native format (such as Microsoft Visio or Adobe Illustrator).

Textual / tabular requirements shall also be submitted electronically in an 5.1.3 editable form.

Data models shall be submitted electronically in a form that is capable of 5.1.4 import into Embarcadero ER/Studio.

All sequencing plans and project schedules shall be submitted electronically in 5.1.5 a form that may be used by Microsoft Project.

All source code shall be delivered in a format appropriate for the 5.1.6 implementation language (e.g., Java, COBOL, XML, BPEL, SQL DDL, SQL DML, ETL tool-specific language, HTML, Perl, UNIX shells script). All source code comprising an executable shall be delivered along with supporting scripts or the equivalent necessary to build, deploy and operate the executable system on the required hardware.

5.2 Deliverable Schedule

• Delivery Minimum (DM)

* 5 work days for FSA to review and comment

* 3 work days for Contractor to respond with updates

* 2 work days for FSA to accept/reject updates

• Delivery Standard (DS)

* 10 work days for FSA to review and comment

* 5 work days for Contractor to respond with updates

* 5 work days for FSA to accept/reject updates

• Delivery Extended (DE)

* 15 work days for FSA to review and comment

* 7 work days for Contractor to respond with updates

* 7 work days for FSA to accept/reject updates

• Delivery Extra (DX)

* 20 work days for FSA to review and comment

* 10 work days for Contractor to respond with updates

* 10 work days for FSA to accept/reject updates

6 CONSTRAINTS

6.1 Statutes

The following non-all-inclusive list of applicable statutes governing this program is provided for informational purposes:

HEA 1965, as amended Privacy Act of 1974 (PL93-502) Freedom of Information Act of 1974 (PL 93-502) Federal Managers’ Financial Integrity Act of 1983 (PL 97-255) Computer Fraud and Abuse Act of 1986 (PL 99-474) Computer Security Act of 1987 (PL 100-235) E-Government Act 2002 Federal Information Security Management Act (FISMA) 2002 Higher Education Reconciliation Act (HERA) 2005 College Cost Reduction and Access Act 2007 (CCRAA) Higher Education Opportunity Act (HEOA) 2008 Ensuring Continued Access to Student Loans Act 2008 (ECASLA) Health Care and Education Reconciliation Act 2010 (HCERA) Consolidated Appropriations Act 2012 MAP-21 (2012) (Public Law 112-141) OMB Circular A-123 Sections 504 and 508 of the Rehabilitation Act of 1973

6.2 FSA’s Lifecycle Management

The Contractor shall follow FSA - Lifecycle Management Methodology 6.2.1 (LMM) (except where agreement is reached between FSA and contractor).

Provide a Contractor Project Management Plan (see LMM) as part of the 6.2.2 Project Management Plan to include the activities outlined in this section as well as any other activities deemed necessary to provide the best value to the Government, manage the requirements of this Contract, and address the constraints identified in Section 6 in this SOO. The Contractor shall coordinate its activities with Systems Integration Division staff as required.

Institute and maintain an effective, efficient, and responsive management 6.2.3 organization that shall oversee all Contractor personnel and subcontractor resources used in the performance of this Contract. The Contractor shall be responsible for ensuring that all tasks and work activities are performed in a timely and cost-effective manner, while maintaining the highest quality of performance.

Incorporate the appropriate plans, stages, activities, products, and stage gate 6.2.4 reviews into its project plan for this Contract. The Contractor shall incorporate only those components that are relevant to the size, scope, and complexity of the activities for this Contract.

6.3 Department/FSA Directives and Standards

This section identifies several of FSA’s infrastructure standards that must be adhered to by vendors. This list is a sample list and is not all-inclusive.

• Applicable IT and security standards, including:

o National Institute of Standards and Technology (NIST) security standards o Federal Information Processing Standards (FIPS) o US Department of Education OCIO-01, Handbook for Information

Assurance Security Policy (2005) o Information Technology Security Certification and Accreditation

Procedures (OCIO-05) o Information Technology Security Configuration Management Planning

Procedures (OCIO-11) o Information Security Incident Response and Reporting Procedures (OCIO-

14) o Protection of Sensitive But Unclassified Information (OCIO-15) o Contractor Employee Personnel Security Screenings (OM: 5-101) o OMB Circular A-130

• Contractor Employee Personnel Security Screening Policy Supplement

• Business Operations Change Management (CM) – The Business Operations

Change Management (CM) process is used to manage change requests (CRs) to hardware and software on all FSA Business Operations Division systems (NSLDS included). CRs are coordinated by the Business Operations Change Management Division, and are stored on a Rational ClearQuest tracking system. Detailed documentation on the CM process, along with contractor responsibilities is available upon request.

• Enterprise Change Management (ECM) - The Enterprise Change Management (ECM) process is used to manage Enterprise Change Requests (ECRs) to FSA hardware and software that are coordinated by the FSA Data Center (DC). A DC (e.g. the Virtual Data Center [VDC]) provides a single computing environment for FSA systems that support the student financial aid process. Project teams, FSA Enterprise level groups or the VDC itself can submit CRs to the VDC. All CRs that impact VDC resources must be coordinated through FSA’s ECM process. The tracking of the CR process is automated through the use of Rational ClearQuest, which was the application selected and customized to manage FSA’s Enterprise Change Management process. Detailed documentation on the ECM process is available upon request.

• System/Application Version Information:

o DB2 (release 10.1) o CICS TS v4.2 o CA Cool Gen (release 8) o QMF (version 10.1) o CA-INSIGHT™ for DB2 (Version R15.0, SP0) o BMC Change Manager (Version 10.01.00) o BMC Catalog Manager (Version 10.01.00) o Web MQ 7.1.0.7 o IBM Enterprise COBOL for z/OS 4.2.0 o IBM z10 2098 - E10 - Q04 with 32 GB memory o Z/OS v1.13

6.4 Vendor Transition

6.4.1. Vendor Transition- Onboarding

The NSLDS Maintenance, Support, and Operations vendor shall provide FSA with an initial high level draft of an onboarding transition work/project plan as part of the proposal. The awardee will operate in parallel with the current contractor as necessary to ensure that all NSLDS Maintenance, Support, and Operations functions are fully transitioned in accordance with a pre-defined and approved transition work/project plan. All contractor parties must ensure that no business disruption occurs during the transition of responsibilities process. Great care is needed to make the transition as smooth as possible for NSLDS customers.

6.4.2. Vendor Transition- Out

The NSLDS Maintenance, Support, and Operations vendor shall provide FSA with a high level draft of a transition out work/project plan as part of the proposal. The awardee will operate in parallel with the new contractor as necessary to ensure that all NSLDS Maintenance, Support, and Operations functions are fully transitioned in accordance with a pre-defined and approved transition work/project plan. The contractor shall coordinate with FSA staff to develop an approved Transition Out Plan for the end of the new contract. The transition plan may be applied at the end of the base year, at the end of any option year, or end of performance. All contractor parties must ensure that no business disruption occurs during the transition of responsibilities process. Great care is needed to make the transition as smooth as possible for NSLDS customers.

6.5 NSLDS Maintenance, Support, and Operations Work Effort Assumptions

NSLDS Maintenance, Support, and Operations will be conducted on the 6.5.1 mainframe, FAP and Student Access websites, and peripheral hardware/system software architecture provided by the VDC (Virtual Data Center hosting service).

Optional: Vendors should include in their response to this SOO an 6.5.1.1 analysis of their capability to provide a direct hosted alternative to the current NSLDS hosted environment on the VDC, in addition to associated cost estimates.

CA Gen Computer Assisted Software Engineering (CASE) tool will be used to 6.5.2 maintain and enhance NSLDS application software and component encyclopedia.

Work efforts will adhere to FSA’s enterprise standards (see Reference Material 6.5.3 section) and will support the objectives defined in the previous sections.

The vendor will be responsible for the complete and thorough testing of all 6.5.4 NSLDS software maintenance work efforts according to FSA’s standards, and quality control best practices (see Reference Material section) prior to deployment into production environment. Testing will include (but not be limited to) performance, system, user acceptance, 508, and inter-system testing. Software maintenance fixes should be deployed during non-business hours, non-peak hours, and in accordance with FSA and VDC standards.

Work efforts will be required to interface, both directly and indirectly, with the 6.5.5 existing FSA Integrated Technical Environment. This technical environment includes both internal and external interfaces.

7 SYSTEM INTERFACES

Below are listed all major interfaces with the NSLDS. For additional information on interfaces, please refer to the Current State document, Interfaces sections for details.

Internal

• Access and Identity Management System (AIMS)

• Aid Data Mart (ADM)

• Common Origination and Disbursement system (COD)

• Central Processing System (CPS)

• Debt Management Collection System (DMCS)

• Direct Loan Consolidation System (DLCS)

• E-Appeals System

• Federal Student Aid Information Center (FSAIC )

• Financial Management System (FMS)

• Gainful Employment Management Solution (GEMS)

• Integrated Student Experience (ISE)

• Office of Inspector General (OIG)

• Ombudsman’s Office

• Participation Management (PM)

• PIN System

• Post-secondary Education Participants System (PEPS)

• Portfolio Performance Management System (PPMS)

External

• ED Servicers (16 servicers; all sharing common file layouts)

• Guaranty Agencies (approx. 37 through a common file layout)

• National Center for Education Statistics (NCES)

• National Clearing House (NCH)

• Schools (thousands, all sharing common file layouts)

• Perkins (Loan) Servicer

• TEACH (Grant) Servicer

• Third Party Servicers (school servicers)

• Temporary and Permanent Disability (TPD) Servicer

APPENDIX A: ACRONYMS

Acronym Definition CASE Computer Aided Software Engineering CDR Cohort Default Rate CFR Code of Federal Regulations COD Common Origination and Disbursement (system) CPS Central Processing System CSC Customer Support Center DL Direct Loan DMCS Debt Management and Collections System DOB Date of Birth (P)DPA (Primary) Destination Point Administrator DPI Data Provider Instructions eCDR electronic Cohort Default Rate ED / “Department” U. S. Department of Education EDCIRC Department of Education’s Computer Incident Response

Capability ED…