Performance Work Statement

Performance Work Statement June 18, 2012

U. S. Department of Education

Office of Special Education Programs (OSEP)

OSEP Personnel Development Program (PDP) Data Collection System:

Scholar Data Report (SDR) and Service Obligations Tracking System (SOTS)

Purpose

The Department requires a single system to more efficiently and effectively collect, analyze, and report data currently collected separately by the SDR and SOTS. The SDR data is required for reporting the Personnel Development Program (PDP) performance required by the Government

Performance and Results Act of 1993 (GPRA), and the SOTS is necessary to track scholar/obligee service obligations as required by Part D of the “Individuals with Disabilities

Education Act” (IDEA). Therefore, it is necessary to consolidate the two current Web sites and web-based data collection systems. In addition, the system must be modified to include data from the additional service obligations resulting from the Personnel Development to Improve

Services and Results for Children with Disabilities--Leadership Preparation in Sensory

Disabilities (Consortium) grants. Data includes, but is not limited to prior employment and training, current training and employment, end of year training status, employment at the time of exit, and service obligation status for all scholars who were enrolled in OSEP-funded PDP grants during each budget year of a grant beginning in fiscal year 2005 and continuing for three years after program completion or until the scholars/obligees’ service obligations are fulfilled

(whichever is greater), or the scholar/obligee enters repayment status. Furthermore, customer service, including, but not limited to information about the Web site, web-based data collection system, programmatic information, requirements and regulations to institutions of higher education (IHEs), scholars/obligees, employers who use the system as well as to the

Department’s Accounts Receivable Group (ARG), will be an important component of this contract.

Background

The PDP is aimed at increasing the supply of effective personnel in the field of special education. This program awards competitive grants to IHEs to support scholars receiving training to provide special education and related services to children and youth with disabilities.

GPRA and IDEA and the related promulgated regulations, i.e., the "Additional Requirements" section of the Personnel Preparation To Improve Services and Results for Children With

Disabilities--Combined and Leadership Priorities for Personnel Preparation notice published in the Federal Register on March 25, 2005 (2005 SO Regulations) and the Federal Register 34 CFR

Part 304 Vol. 71 No. 107 June 5, 2006, the Service Obligations Under Special Education–

Personnel Development to Improve Services and Results for Children with Disabilities (2006 SO

Regulations), place requirements on the PDP that require data collection for two main purposes.

First, GPRA requires OSEP to report performance measure data on PDP grants awarded to IHEs.

Second, the Department is required to track the service obligations of scholars/obligees who receive funding from a PDP grant to ensure that they work in the field of special education or related services for a specified period of time or repay part or all of the funding received.

The three data sets that will be consolidated under this acquisition are: (1) The SDR which collects most of the PDP performance measure data; (2) the SOTS which tracks the eligible employment of scholars who have received funding from most of the PDP training grants awarded by OSEP; and (3) the Consortium data from grants awarded by OSEP to prepare educators with expertise in the education of students with sensory impairments. For further information about these entities, visit: https://oseppdpprs.ed.gov for SDR, http://www.serviceobligation.org for NCSO, and http://www.salus.edu/nclvi/fellows.htm and http://www.salus.edu/nlcsd/ for the Consortium.

The following sections on performance measures, service obligations and the Consortium describe these functions in greater detail.

Performance Measures

This contract will collect, analyze and report data for each of five years as follows. The collection, analysis and reporting of data for the first performance measure below is and will continue to be supported under a separate contract dedicated to IDEA Part D GPRA Performance

Measurement. Information on the Personnel Development Performance Measures and a description of the source of data for the measures can be found at:

http://www.ed.gov/about/reports/annual/2010report/program.html. The Personnel Development

Program performance measures are as follows:

(1) The percentage of Special Education Personnel Development projects that incorporate evidence-based practices into their curricula;

(2) The percentage of scholars completing funded Special Education Personnel Development programs who are knowledgeable and skilled in evidence-based practices for infants, toddlers, children, and youth with disabilities;

(3) The percentage of Special Education Personnel Development funded scholars who exit preparation programs prior to completion due to poor academic performance;

(4) The percentage of Special Education Personnel Development funded degree/certification program recipients who are working in the area(s) in which they were prepared upon program completion;

(5) The percentage of Special Education Personnel Development funded degree/certification recipients who are working in the area(s) for which they were prepared upon program completion and who are fully qualified under IDEA;

(6) The percentage of Special Education Personnel Development degree/certification recipients who maintain employment in the area(s) for which they were prepared for three or more years and who are fully qualified under IDEA; and

(7) The Federal cost per fully qualified Special Education Personnel Development funded degree or certification recipient.

https://oseppdpprs.ed.gov/ http://www.serviceobligation.org/ http://www.salus.edu/nclvi/fellows.htm http://www.salus.edu/nlcsd/ http://www.ed.gov/about/reports/annual/2010report/program.html

The description and methodology for all seven program performance measures are submitted to

Congress in ED’s Fiscal Year 2012 budget justification. The most recent report for this program is located at http: http://www2.ed.gov/about/overview/budget/budget12/justifications/i-specialed.pdf

Under this contract, the following three OMB-requested measures will be added to the existing data collection:

(1) The number and percentage of degree/certification recipients who are employed in high-need schools

(2) The number and percentage of degree/certification recipients who are employed in a school for at least three years.

(3) The number and percentage of degree/certification recipients who receive a positive evaluation from their employer.

Service Obligations

This contract will collect data from IHEs, scholars/obligees and employers to track the eligible employment of scholars/obligees, who have been awarded scholarships from Personnel

Development Program grants, until their service obligations are fulfilled or they are referred to the ARG for repayment of part or all of the funding received. In order to facilitate this process, the current secure, online database used to collect scholar contact and service obligation information must be improved and maintained to ensure fulfillment of the service obligation as defined in the regulations. As of 14

2012, 10,324 scholar/obligee records had been submitted and 505 were pending.

Consortium

This contract will collect data from IHEs, scholars/obligees, and employers to track the eligible employment of Consortium scholars/obligees. The Consortium is comprised of two grants with a current total of 47 scholars/obligees. The requirements for these scholars/obligees are different than the requirements for the scholars/obligees tracked by the SOTS. For further information, visit the Web sites provided in the Background section above. Additional information will be provided after the award is made.

Authorizing Legislation and Regulations for Performance Measures and Service

Obligations

The legislative authority for a performance measure acquisition is found in PL 108-446 Part D

Section 682 (c) PROGRAM EVALUATION. – The Secretary may use funds made available to carry out subpart 2 or 3 to evaluate activities carried out under subpart 2 or 3, respectively.

The authorization for a service obligations acquisition is found in Public Law 108-446, Section

662 (20 U.S.C. 1400) that addresses providing personnel development to improve services and http://www2.ed.gov/about/overview/budget/budget12/justifications/i-specialed.pdf http://www2.ed.gov/about/overview/budget/budget12/justifications/i-specialed.pdf results for children with disabilities (http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=108_cong_public_laws&docid=f:publ446.108).

The Service Obligation language in IDEA, Part D, Section 662(h), states that:

(1) Each application for assistance… shall include an assurance that the eligible entity will ensure that scholars who receive a scholarship under the proposed project agree to subsequently provide special education and related services to children with disabilities, or in the case of leadership personnel to subsequently work in the appropriate field, for a period of 2 years for every year for which the scholarship was received or repay all or part of the amount of the scholarship, in accordance with regulations issued by the Secretary.

(3) Secretary's responsibility.--The Secretary--``(A) shall ensure that individuals described in paragraph (1) comply with the requirements of that paragraph;

The Service Obligation regulations delineate the requirements. (See "Additional Requirements" section of the Personnel Preparation To Improve Services and Results for Children With

Disabilities--Combined and Leadership Priorities for Personnel Preparation notice published in the Federal Register on March 25, 2005 at http://edocket.access.gpo.gov/2005/pdf/05-5957.pdf and the Service Obligations Under Special Education – Personnel Development to Improve

Services and Results for Children with Disabilities, 34 C.F.R. § 304, Vol. 71 No. 107 June 5, 2006 at http://www.gpo.gov/fdsys/pkg/FR-2006-06-05/pdf/06-5111.pdf).

Scope of Work

The term of the contract shall be a 12 month base followed by four 12 month option periods.

Option periods will be exercised at the discretion of ED based on Contractor performance, program need, and available funds.

Where unspecified, allow a minimum of five calendar days for the review and approval of all contractual deliverables. Unless otherwise specified, one (1) electronic copy and one (1) paper copy of all reports shall be submitted. Deliverables received in advance of their due date will be welcome.

Task 1 Conduct an Initial Planning Meeting.

The Contractor shall arrange a two-day meeting, within one week after award of this contract, with the COR and other relevant Department officials to discuss the details of the contract and provide clarification as needed. The COR will identify the time and location for the meeting at

Department office in Washington, D.C. and will assume responsibility for inviting all appropriate Department staff. The Contractor, with COR approval, shall provide an agenda for the meeting, including review of the management matrix that was submitted with the proposal.

The Contractor shall provide meeting minutes documenting the major decisions made at this meeting to the COR within two days after the planning meeting. The Contractor shall submit the final management matrix to the COR no later than one week after the planning meeting. The

Contractor shall update the management matrix annually.

http://edocket.access.gpo.gov/2005/pdf/05-5957.pdf http://www.gpo.gov/fdsys/pkg/FR-2006-06-05/pdf/06-5111.pdf

Deliverables:

1.1 Initial planning meeting agenda. The Contractor shall provide the COR with an agenda for the initial planning meeting at least three days prior to the meeting.

1.2 Schedule of deliverables. The Contractor shall provide, at the initial planning meeting, a schedule of deliverables with hard calendar dates for COR review and approval that are based on the timeframes set forth in this PWS.

1.3 Initial planning meeting minutes. The Contractor shall provide meeting minutes documenting the major decisions made at this meeting to the COR within two days after the planning meeting.

1.4 Final management matrix. The Contractor shall submit the final management matrix to the COR no later than one week after the planning meeting. The COR has one week to review and provide edits.

1.5 Annual management matrix update. The Contractor shall update the management matrix annually.

Task 2 Consult and Maintain Communication with the COR.

The Contractor shall maintain regular communication with the COR by telephone and email. The

Contractor shall schedule and participate in two teleconferences each month with the COR. The

Contractor shall prepare an agenda and written summary of the meetings (teleconferences) and submit the summary to the COR within two days after the meeting.

The Contractor shall submit a monthly progress report of not more than 20 pages during each year of this contract. Each report shall include the following information: (1) the status of each ongoing task; (2) a log of all questions from IHEs, scholars, employers, and others, and a summary of Contractor’s responses, including date and time the request was received and the response provided; (3) a discussion of any major barriers encountered that may affect the time and quality of deliverables and associated tasks and plans to resolve any discrepancies; and (4) a discussion of any decisions/actions required by the Department.

2.1 Written Agenda for Twice-Monthly Teleconferences. The Contractor shall schedule, initiate, and participate in twice- monthly teleconferences with the COR. The Contractor shall prepare an agenda for each teleconference and email to the COR at least three days prior to each teleconference.

2.2 Discussion Documents. The Contractor shall provide the COR via e-mail any documents that will be discussed during a teleconference at least three days prior to the teleconference.

2.3 Written Summary of Twice-Monthly Teleconferences. The Contractor shall prepare a written summary of the each teleconference and submit the summary to the COR within two days after the teleconference.

2.4 Monthly Progress Reports. The Contractor shall submit monthly progress reports to the COR and Contract Specialist within one week after the end of each reporting month.

Task 3 Transfer Two Web sites, Two Web-based Data Collection Systems and the

Consortium Data (Currently Collected Manually by IHEs) to the New Contractor

OSEP shall facilitate the transfer of the existing Web sites, web-based data collection systems, and all related data from the existing Contractors within ten days after award of the contract.

In addition, OSEP will facilitate the transfer of the existing data from the Consortium IHEs to incorporate into the consolidated and modified Web site and web-based data collection system.

The contractor shall provide a solution for collecting the Consortium legacy service obligation information and performance measure data, determine how to calculate the Consortium service obligations, and develop a method to collect data from Consortium IHEs, scholars and employers.

3.1 The contractor shall receive the existing Web sites, web-based data collection systems, and all related data from the existing contractors within 10 day after the award of the contract.

3.2 The contractor shall provide to the COR a written confirmation specifying what was received from the Contractors and the date of the receipt.

3.3 The contractor shall have entered all Consortium legacy data 32 weeks after the award of the contract.

Task 4 Consolidate Two Web sites and Two Web-based Data Collection Systems and

Modify the System for the Consortium Service Obligation Data

Because the Contractor may not have the same platform or the same program associated with the current web-based data collection systems, the Contractor shall design a system and make all modifications necessary to ensure that all aspects of the Web site and web-based data collection system are fully operable, including data collection for the Consortium. The system shall provide for both public and secure links. The secure link must be accessible only by the IHEs, scholars/obligees and employers that will be entering data and for whom logins and passwords will be provided by the Contractor. Public links shall include, at a minimum, access to: a description of the purpose of the data collection, the data collection instruments, data submission instructions, frequently asked questions, performance measure results, and training modules.

Descriptions of the SDR and SOTS web-based data collection systems follow:

SDR web-based data collection system.

The SDR, an existing data collection instrument, and the web-based data collection system are designed to collect information annually from all OSEP PDP grants on each scholar who received scholarship support or was enrolled in the grant support program during the grant budget period. Each grantee submits data on the characteristics, prior employment and training, current training and employment, end of year training status, and employment at the time of exit for each scholar who was enrolled in the OSEP-funded program during each grant budget year.

Grants are funded for four years (five year awards began in FY 2011), and grantees submit SDR data for each fiscal year that they are active (that is, for each year that they receive federal funds or are in a no-cost extension period). It is estimated that approximately 450 grants are active in a fiscal year (including those in a no-cost extension period) and that approximately 7500 scholars are enrolled each year in these grant-supported programs. The majority of scholars receive grant support for more than one year. Grantees submit and then update data on these scholars for each year that they are enrolled in the OSEP-funded program. The SDR has undergone several revisions. The current SDR has OMB approval (OMB 1820-0530) with an expiration date of

January 31, 2014.

The web-based data collection system resides on a server at the site of the current Contractor.

The centralized online data entry application was built using HTML and ASP.NET 4.0 with the data stored in a centralized MS SQL 2000 Server database. The application consists of approximately 100 HTML and ASP pages. It includes an on-line version of the survey instrument with text boxes, drop-down lists, check boxes, and radio buttons that replicates the

OMB-approved SDR. Java Script is used to perform edit checks and skip patterns to maximize the reliability of the data. In addition, the application includes secure access, online data status reports, and email receipts to grantees. An Access application produces data entry status reports for system administrators and provides a means to manage grantee passwords. The current

Contractor manages all data in an MS SQL Server database management system (DBMS) and manages the production Web site running Microsoft’s Internet Information Server (IIS) version

6.0. OSEP will facilitate the transfer of the current the SDR and the web-based data collection system to the Contractor for performance under this contract within ten days after contract award.

These annual data have been collected, analyzed and reported to OSEP since FY 2001. The results of some of the analyses conducted on data sets (FY 2001 through FY 2009) can be viewed on the Web site identified above.

Description of the SOTS web-based data collection system.

The SOTS, an existing web-based data collection system is designed to collect information on a continuous basis from all OSEP PDP grantees, scholars/obligees, and employers. The system is approved at the moderate security level and maintains social security numbers which is necessary for tracking scholar/obligee service obligations. The SOTS is a secure, online database used to track the fulfillment of service obligations. The SOTS has four types of user access levels: Contractor administrators, IHEs, scholars/obligees and employers. IHEs are responsible for entering the contact, training and service obligation details of funded scholars/obligees. Scholars/obligees upload their updated contact and employment information in the SOTS and employers access the SOTS to verify the employment of scholars/obligees.

IHEs can view the service obligation status for the scholars/obligees they have entered.

Scholars/obliges have access to detailed dashboard of their service obligation owed and total obligation fulfilled to date based on the employment information entered. Employers are provided a simple online report where they can verify the employment information provided by the scholar/obligee.

The SOTS has both a web server and a database server which are housed at a third party server hosting data center. SOTS uses Microsoft Windows Server 2003 Standard Edition, Symantec

Endpoint Protection Antivirus for Windows, Cold Fusion 8 Application Server web server software. The data base server software consists of Microsoft Windows Server 2003 Standard

Edition – 32 bit, Symantec Endpoint Protection Antivirus for Windows, MS SQL Server 2005, Standard Edition with SP 2, Network Event Viewer, and Backup storage software. NCSO also uses Microsoft Windows Server 2003 Standard Edition – 32 bit, Symantec Endpoint Protection

Antivirus for Windows, MS SQL Server 2005, Standard Edition, with SP 2, Network Event

Viewer, Backup storage software for database server software. OSEP will facilitate the transfer of the current SOTS and the web-based data collection system to the Contractor for performance under this contract within ten days after contract award.

Subtask 4.1 The Contractor will provide a solution for combining the two systems and a modification for the Consortium service obligation data collection. In addition, the system will allow the Department to access, through a secure server, information or documents that include social security numbers.

OSEP service obligation scholar data must be continuously maintained beginning with FY2005 grant awards. For performance measure data, SDR data must be continuously maintained beginning with FY 2001, all data must be archived for analysis purposes. Current data collection efforts for both the SDR and the Consortia represent enrolled scholars. These data are collected cross-sectionally, and on an annual basis. Each year's data collection is for one fiscal year, for example, the SDR data collection was just completed for FY 2010. This new contract will collect data for FY 2011.

Additional information about the SDR and SOTS systems will be provided by OSEP after contract award.

4.1.1 Within eight weeks after the award date, the Contractor shall provide a draft design document, with accompanying Web site on a test server showing a consolidated and modified user friendly Web site and web-based data collection system that includes SOTS, SDR and

Consortium data collections and includes the option for IHEs to download and upload documents.

4.1.2 Allowing one week for the COR to review and comment, on both the document and the test Web site, the Contractor shall submit the final design no later than ten weeks after the award date.

4.1.3 Within ten weeks after the award date, the Contractor shall provide a final design document, showing a consolidated and modified user friendly Web site and web-based data collection system that includes SOTS, SDR and Consortium data collections and includes the option for IHEs to download and upload documents and allow access for the Department to access information or documents with social security numbers.

4.1.4 Allowing two weeks for the COR to review and comment, the Contractor shall submit the final design no later than 14 weeks after the award date.

4.1.5 Within 18 weeks after award date, the Contractor shall provide written assurance that all aspects of the Web site and web-based data collection system are fully operational and provide access to the system for COR review.

4.1.6 Allowing two weeks for the COR to review and comment, the Contractor shall certify, in writing and demonstrate to OSEP, no later than 22 weeks after the award date that any

COR concerns have been addressed and that the system is operational, and ready for IHE, scholar/obligee and employer data entry, and all legacy data has been incorporated into the system. OCIO approval for operation should also occur no later than 22 weeks after the award date.

Subtask 4.2 The contractor shall host the existing Web sites and web-based data collection systems independently until the consolidated system is operational.

Subtask 4.3 The contractor shall ensure that the Web site, the web-based data collection system, and web-based trainings are 508 accessible.

Task 5 IT Security Clearance for the Web-based Data Collection System

The Contractor shall comply with the Department's IT security policy requirements as set forth in the Handbook for Information Assurance Security Policy and related procedures and guidance. The Contractor shall comply with IT security requirements in the Federal Information

Security Management Act (FISMA) www.csrc.nist.gov/sec-cert/index.html , Office of

Management and Budget (OMB) Circulars www.whitehouse.gov/omb/circulars/index.html , and the National Institute of Standards and Technology (NIST) standards and guidance www.nist.gov .

These requirements include the successful certification and accreditation of the system before it can be implemented. To ensure the system can be certified and accredited, security controls shall be designed and implemented in the system consistent with the NIST 800-53 –

Recommended Security Controls for Federal Information Systems identified for the impact level of the system www.csrc.nist.gov/publications/nistpubs/800-53/sp800-53.pdf. The impact level will be determined via the completion of the Department’s inventory form and critical infrastructure protection survey.

System security documentation shall be developed to document the implementation of the security controls for the system and the Contractor shall be available for interviews and demonstrations of security control compliance to support the certification and accreditation process. In addition, vulnerability scanning and penetration testing shall be performed on the hosting facility and application by the Department’s Certification Review Group as part of the certification and accreditation process. Appropriate access agreements will be reviewed and signed before any scanning or testing occurs. (See the Appendix: Sample Certification and

Accreditation Steps of System Not on EDNet) This process takes approximately 8-10 weeks or more, depending on the availability of the system for testing, the findings, and the Contractor’s ability to respond to areas of concern. The Contractor shall, in consultation with the Department, develop and maintain a Web site to use throughout the life of the project. The Web site shall be hosted by the vendor, and will be compatible with ED’s Web site, www.ed.gov http://www.csrc.nist.gov/sec-cert/index.html http://www.whitehouse.gov/omb/circulars/index.html http://www.nist.gov/ http://www.csrc.nist.gov/publications/nistpubs/800-53/sp800-53.pdf file://www.ed.gov

<<http://www.ed.gov>>, and follow applicable sections of the ED.gov Management and

Publishing Policies (http://www.ed.gov/internal/wwwstds.html) and the ED.gov Style Guide

(http://www.ed.gov/internal/styleguide/index.html). The Web site shall feature any appropriate deliverables associated with the project. Therefore deliverables, where indicated, should be submitted in such a way so that they can be hosted on the vendor’s or ED’s Web site. Web applications will use software compatible with ED’s Web site (i.e., Macromedia ColdFusion, Microsoft SQL Server, IBM WebSphere, Oracle Database Management System) to facilitate migration to www.ed.gov <<http://www.ed.gov>> for hosting at the end of the contract; ED may waive the compatibility requirement on request on a case-by-case basis.

Internet Protocol version 6 (IPv6), The Contract shall provide COTS solutions that are IPv6 capable. An IPv6 capable system or product shall be capable of receiving, processing, transmitting and forwarding IPv6 packets and/or interfacing with other systems and protocols in a manner similar to that of IPv4. Specific criteria to be deemed IPv6 capable are:

An IPv6 Capable system must meet the IPv6 base requirements defined by the USGv6 Profile and Testing program as found here “http://w3.antd.nist.gov/usgv6/testing.html”.

Systems being developed, procured or acquired shall maintain interoperability with IPv4 systems/capabilities.

Systems shall implement IPv4/IPv6dual-stack and shall also be built to determine which protocol layer to use depending on the destination host it is attempting to communicate with or establish a socket with.

If either protocol is possible, systems shall employ IPv6. The contractor shall provide IPv6 technical support for system development, implementation and management.

System Development Standards: Information systems shall be developed in accordance with the

ED Lifecycle Management Framework (LCM), ACS-OCIO 1-106.

The Contractor shall comply with and make use of the Department's Enterprise Data Dictionary for definitions used in creating the database Please contact the OCIO EA Data Architecture

Team for assistance via email at EA.help@ed.gov .

The Contractor shall coordinate creation of data definitions for any new data fields with the

OCIO EA Data Architecture Team. The Contractor shall provide regularly updated data extracts in .xml format so that the Department has the ability to import the data into the Enterprise reporting system (EDFacts) should it choose to do so.

The Contractor shall provide to OCIO system documentation for inclusion in the Enterprise Data

Dictionary. This includes data schema and data dictionary documentation such as: Information

Exchange Matrix, which describes data exchanges between systems; Logical Data Model;

Physical Data Model; Activity/Entity Matrix; Data Dictionary.

http://www.ed.gov/ http://www.ed.gov/internal/wwwstds.html http://www.ed.gov/internal/styleguide/index.html file://www.ed.gov http://www.ed.gov/ mailto:EA.help@ed.gov

The Contractor shall comply with the Privacy Act as required by the FAR (48 CFR 3424.1 and

48 CFR Subpart 24.1 and the clauses at 48 CFR 52.224-1 (Privacy Act Notification) and 52.224-

2 (Privacy Act Requirements). For complete Federal Acquisition Regulation (FAR) visit www.acqnet.gov.

The Contractor will perform the initial self-assessments and prepare a Plan of Action and

Milestones (POA&M) identifying areas in need of improvement. The Contractor will prepare the Certification and Accreditation (C&A) package and confirm that the security controls described in the system security plan are consistent with the categorization level and appropriately tailored to the web based data collection system. Updates will be provided as needed, but no less than annually. The Contractor will work with the COR to submit all of the necessary forms and will respond to concerns and requests for additional documentation from the

U. S. Department of Education, Office of the Chief Information Officer (OCIO).

After receiving final approval from OCIO, the Contractor will complete work identified in the

POA&M and will perform all ongoing quarterly system reviews and security reporting providing updates as needed, but no less than quarterly, on progress on the POA&M as well other security requirements. The Contractor will continue ongoing reporting and monitoring and identify any new areas in need of improvement and work with the COR to send the appropriate documentation with OCIO. Prior to the expiration of the C&A approval, the Contractor will work with the U. S. Department of Education to conduct the required recertification and reaccreditation.”

5.1 Annual security control assessment consistent with NIST SP 800-53 and NIST SP

800-.

5.2Complete the Department’s inventory form and critical infrastructure protection survey.

5.3 System security plan, configuration management plan, contingency plan consistent with NIST 800-53, and the Department’s baseline security requirements.

5.4 Within ten weeks after award date, the Contractor shall begin to work with the

Department to schedule, cooperate with, and successfully complete a C&A of its system. The

Contractor shall provide written assurance that the Web site address conforms to the

Department’s requirements. Coordinate with the Department on quality control requirements.

5.5 Within seven weeks after award date, the Contractor shall submit a full description of the quality control process that will be implemented.

5.6 The Contractor shall describe any upgrades or enhancements that are made to the system in the monthly progress reports required under Task 1.

5.7 The Contractor shall complete specific activities under the U. S. Department of

Education’s security requirements including quarterly system reviews and security reporting, annual system reassessments, and periodic recertification. Specific activities to be included as deliverables are: Quarterly POA&M Status Reports; Plan of Action and Milestones (updated as needed but no less than quarterly) and C&A Package including System Security Plan, Configuration Management Plan and Contingency Plan (updated as needed but no less than annually).

http://www.acqnet.gov/

Task 6: Quality Control of the Web site and Web-based Data Collection System

The Contractor shall maintain the consolidated Web site and web-based data collection system on a publicly accessible server, and shall conduct all maintenance and support necessary for its use. All postings on the Web site will be approved by the Department and are subject to the relevant guidelines in U.S. Department of Education Technical Standards and Guidelines

(http://www.ed.gov/internal/wwwstds.html). The Contractor shall develop and implement a quality control process to ensure that all aspects of the Web site and web-based data collection system are maintained and operated as intended. The Contractor shall make minor enhancements, upgrades, or improvements to the system to address all problems that are identified through the quality control process. The current URLs for the SDR, SOTS and

Consortium are: https://oseppdpprs.ed.gov for SDR, http://www.serviceobligation.org for

SOTS/NCSO, and http://www.salus.edu/nclvi/fellows.htm and http://www.salus.edu/nlcsd/ for the Consortium. A new URL for the consolidated system will be determined by the Contractor in consultation with the COR. The Web site must be up and running 24 hours a day, 7 days each week 99.9% of the time. Maintenance work must be completed during off peak hours.

Subtask 6.1 The Contractor will complete the 53A, and the Department’s baseline security requirements in preparation for annual FISMA reporting as follows:

6.1.1 Plan of Action and Milestone update in response to the latest security control assessment and any discovered vulnerabilities, weaknesses, or audit findings (to be completed at the same time the security control assessment is completed);

6.1.2 Department’s Inventory Form/Data Sensitivity Worksheet, NIST 800-60 Information

Types Mapping Worksheet, Critical Infrastructure Protection Survey (consistent with FIPS 199 and updated as needed but no less than quarterly);

6.1.3 Completion of annual contingency plan test and documented test results frequency and intensity of training will be based on the availability categorization of the system. (to be completed, as required, in preparation for annual FISMA reporting);

6.1.4 Contractor support staff provide interviews and demonstrations of security control implementation upon request of the Certification Review Group certification and accreditation reviews and requests from ED Information Assurance;

6.1.5 Contractor support staff provide technical assistance for vulnerability scanning and penetration testing of the facility upon request of the Certification Review Group certification and accreditation reviews and requests from ED Information Assurance; and

6.1.6 Contractor support staff complete annual IT security awareness and specialized security training.

6.1.7 The Contractor shall ensure that the site complies with privacy policies as outlined in

OMB Memorandum M-03-22 http://www.ed.gov/internal/wwwstds.html https://oseppdpprs.ed.gov/ http://www.serviceobligation.org/ http://www.salus.edu/nclvi/fellows.htm http://www.salus.edu/nlcsd/ http://www.usa.gov/webcontent/reqs_bestpractices/omb_policies/privacy.shtml which requires the posting of a privacy policy.

6.1.8 The Contractor shall ensure that any non Federal sponsored Web sites or content (outside of .gov, .mil, .Fed.us, etc.) that is linked to complies with “ED.gov Management and Publishing

Policies” at http://www2.ed.gov/internal/wwwstds.html#link and the OMB Memorandum M-05-

04, “Policies for Federal Agency Public Web Sites” at http://www.whitehouse.gov/omb/memoranda/fy2005/m05-04.pdf.

6.1.9 The Contractor shall use a hostname identify by OSEP. A ".gov" domain name

(typically hostname.ed.gov) is required for all government funded web sites under OMB

Memorandum M-05-04;

(http://www.usa.gov/webcontent/reqs_bestpractices/omb_policies/domains.shtml).

6.1.10 The Contractor shall ensure that any "ED-Sponsored" content or deliverables must be identified prominently with U. S. Department of Education, and the ED.gov logo should be displayed prominently and link to the ED.gov home page. The complete policy is described in the “ED.gov Management and Publishing Policies” at http://www2.ed.gov/internal/wwwstds.html#sponsor.

6.1.11 The Contractor shall ensure that the Web site must display a disclaimer or warning when a user follows a link from a Department Web site to a non-Government Web site. The disclaimer must state that the site they are connecting to is not part of the ED.gov domain.

6.1.12 The Contractor shall ensure that the Web site must comply with the Federal Information

Security Act of 2002 (FISMA).

Task 7 Prepare OMB Information Collection Packages

No data shall be collected without OMB clearance. If, for any reason, OMB should refuse to grant forms clearance for this collection, this contract shall be terminated in accordance with the terms of the contract.

The current two forms clearance package submissions will need to be consolidated, revised and submitted to OMB. The Contractor shall provide consultation and support during the forms clearance process and shall submit written responses to questions from OMB or revise instruments, as requested by the COR, The Contractor shall, if necessary, meet with the COR and OMB staff to discuss the clearance package. The Contractor shall submit the draft forms clearance package to the COR within 8 weeks after the effective date of contract and the final package within 10 weeks. The current approved information collection clearances can be found in the Department of Education Information Collection System (EDICS) at http://edicsweb.ed.gov/. The SDR and NCSO identification numbers are respectively 1820-

0530 and 1820-0686.

At the present time, OMB clears instruments for a maximum of three years; thus, it may be necessary to prepare a clearance package at the beginning of this contract and again after three years.

https://email.ed.gov/OWA/redir.aspx?C=6ec13dd48bff412ea1d8910c3a5d7188&URL=http%3a%2f%2fwww.usa.gov%2fwebcontent%2freqs_bestpractices%2fomb_policies%2fprivacy.shtml https://email.ed.gov/OWA/redir.aspx?C=6ec13dd48bff412ea1d8910c3a5d7188&URL=http%3a%2f%2fwww2.ed.gov%2finternal%2fwwwstds.html%23link https://email.ed.gov/OWA/redir.aspx?C=6ec13dd48bff412ea1d8910c3a5d7188&URL=http%3a%2f%2fwww.whitehouse.gov%2fomb%2fmemoranda%2ffy2005%2fm05-04.pdf https://email.ed.gov/OWA/redir.aspx?C=6ec13dd48bff412ea1d8910c3a5d7188&URL=http%3a%2f%2fwww.usa.gov%2fwebcontent%2freqs_bestpractices%2fomb_policies%2fdomains.shtml https://email.ed.gov/OWA/redir.aspx?C=6ec13dd48bff412ea1d8910c3a5d7188&URL=http%3a%2f%2fwww2.ed.gov%2finternal%2fwwwstds.html%23sponsor http://edicsweb.ed.gov/

7.1 Within eight weeks of award, submit to the COR a draft forms and clearance package for the consolidated data collection system (initial submission).

7.2 Within 12 weeks of award, submit to the COR a final forms and clearance package for the consolidated data collection system (initial submission).

7.3 Within 24 weeks prior to the expiration date of the first approved clearance above, submit to the COR a draft forms and clearance package for the consolidated data collection system.

7.4 Within 22 weeks prior to the expiration date of the approved clearance above, submit to the COR a final forms and clearance package for the consolidated data collection system.

Task 8: Establish a Procedural Handbook

Using the procedural handbooks developed by the existing Contractors for the SDR, SOTS and

Consortium, develop a handbook based on those requirements and any new requirements of this system, including methodologies for the performance measures and procedures for customer service, that will ensure that contract personnel understand the requirements of this contract.

A draft procedural handbook shall be submitted to the COR 12 weeks after the award of the contract. Allowing three weeks for the COR to review and comment, the Contractor shall submit the final procedures handbook no later than 17 weeks after the award of the contract.

8.1 Draft procedural handbook. The draft handbook shall be submitted to the COR 12 weeks after the award of the contract and allow three weeks for COR review.

8.2 Final procedural handbook. The Contractor shall submit the final handbook no later than 17 weeks after the award of the contract

TASK 9 Service Obligation Data Collection and Technical Assistance to IHEs, scholars and employers

The web-based data collection system shall be open continuously for all IHEs, scholars, and employers to enter service obligation data, including social security numbers. The Contractor shall develop or modify the web-based data collection system to enable collection of data to meet the differing service obligation requirements and regulations that exist.

The Contractor shall revise or develop frequently asked questions (FAQs). The contractor shall propose a method to ensure that IHEs, scholars/obligees, and employers get answers to their questions about the web-based data collection system and the service obligation regulations or requirements.

The Contractor shall develop two service obligation Web pages on the Web site—one that provides information and FAQs for IHEs, scholars, and employers that have service obligation requirements and regulations based on the 2005 SO requirements and the 2006 SO regulations and a second page that provides information and FAQs for the Consortium IHEs, scholars and employers.

In addition, a toll-free customer service hotline and an e-mail address will be established within eight weeks of the effective date of the contract for IHEs, scholars/obligees and employers to use to ask questions regarding service obligation requirements and the web-based data collection system. Operators for the hotline, including TTY, will be available at least eight hours per day, Monday through Friday, and questions submitted by e-mail will receive an immediate auto-response. Service obligation questions will receive a response within two business days. The contractor shall forward to the COR programmatic and regulatory questions that the contractor is not prepared to answer. This may increase the time it takes to respond to these questions. The

Contractor shall maintain a log of all questions and answers and use the log to respond to similar questions. The log of all questions and answers shall be submitted to the COR on a monthly basis for review.

The Web site resource information shall include, but is not limited to access to the web-based data collection system, service obligation history, FAQs and the OMB-approved IHE/scholar

Service Obligation Agreement and Exit Certification. The contractor shall revise the Web site and web-based data collection system, as needed. Changes may include, but are not limited to requirements or regulations, FAQs, information briefs, or OMB-approved questions. The Web site information shall be available in hard copy and other accessible formats, as necessary.

9.1 Draft resource materials shall be submitted to the COR within eight weeks of the effective date of the contract.

9.2 Allowing two weeks for COR review, final resource materials shall be submitted within 12 weeks after the effective date of the contract.

9.3 On a monthly basis, the contractor shall submit a log of all questions about the service obligations along with recommendations for FAQ updates for COR approval, and shall add the approved FAQ updates to the Web site within five days of COR approval, and submit confirmation to the COR that the updates have been completed.

TASK 10 Procedures for Service Obligation Repayment

The Contractor and COR shall meet with the Department’s ARG to review and update procedures for contacting the scholar/obligee and ARG when the contractor determines, based on the regulations and requirements and the collected data, that a scholar/obligee has entered repayment status. The contractor will be responsible for developing materials/notifications related to repayment, but not for printing or mailing to scholars/obligees. Most materials and notifications will be made electronically (encrypted if PII is included with a separate e-mail with the password) or by telephone. The revised procedures shall be submitted to the COR.

Following review by the COR, the Office of General Counsel, and ARG, the final procedures shall be implemented.

10.1 10.2 Draft procedures for interacting with ARG within one month of the award of the contract.

10.2 Final procedures for interacting with ARG within two months of the award of the

TASK 11 Reports Related to Service Obligations

Subtask 11.1 Prepare Brief Service Obligation Data Summaries

Occasionally, but no more than an average of ten times per year throughout the course of the contract, the COR will request brief summaries of the data or findings. In response to those requests, the Contractor shall submit two-page texts in narrative style or bullet formats along with Excel data tables, when appropriate, and PowerPoint slides, at the discretion of the COR, no more than one week after the request. The COR has one week to review the draft.

11.1.1 Draft brief data summaries shall be submitted within one week of the COR’s request.

11.1.2 Final data summaries shall be submitted within one week after receipt of the

COR’s comments.

TASK 12 Performance Measure Data Collection

The performance measure data will be collected at a specific time during the year. For collection of these performance measure data, the following procedures apply. The Contractor shall prepare individual notification letters to be sent under electronic signature of the Director of

OSEP’s Research to Practice Division. The letters shall be sent electronically via email to inform

FY2011 active grantees about the purpose for the performance measure data collection and the grantee’s responsibilities for entering data accurately and within given timelines; the Web site address for grantee to review accessible information on the Web site prior to collecting and submitting scholar data; reminder that grantee is free to secure responses to appropriate items directly from scholars enrolled in the grant-support program but that the responsibility for ensuring the accuracy of the data and for submitting the data electronically and on time rests with the project director of the grant; the date on which the project director may begin to enter and complete data submission; information on how each grant’s log in and passwords for access to the secure web-based data collection system will be available; and contact and help desk information for responding to data entry questions.

All notification letters to FY 2011 active grantees who submitted data during the FY 2010 data collection period shall also include clarification of grantees’ responsibility for updating information on scholars who they reported during the FY 2010 data collection period as continuing to be enrolled in the grant supported program. The Web site for the OMB approved data collection form shall be provided with all notifications. The Contractor shall send the required notification to each FY 2011 active grantee in a manner that provides to the Contractor an electronic receipt (return receipt) to verify that the notification has been received by the grant project director.

The Contractor shall also notify each grantee by email alerting them of the upcoming data collection and that they will be receiving the notification. For the purpose of updating contact information, follow up phone calls will be made by the Contractor to all grantees for whom emails were undeliverable. The Contractor shall make reasonable effort to locate all grantees for which contact information in the database received from OSEP is incorrect or not current. The

COR will cooperate with the Contractor in locating current contact information, as necessary. In addition to the official notification, the Contractor shall send reminders by email to grantees three weeks prior to the date on which they can begin entering data.

Data entry start and end dates is for a 60 day period commencing no later than

February 3, 2013 and ending no later than April 4, 2013. The data submission process should be complete no later than April 4 of each data collection year.