Amendment_0001.pdf

NSN 7540-01-152-8070 STANDARD FORM 30. (Rev. 10-83) Previous Edition unusable Prescribed by GSA FAR (48 CFR) 53.243

Page of Pages AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. Contract ID Code

2. AMENDMENT MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (if applicable)

6. ISSUED BY CODE 7. ADMINISTERED BY (If other than item 6) CODE

(x) 9A. AMENDMENT OF SOLICITATION NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

8. NAME AND ADDRESS OF CONTRACTOR (NO., Street, Country, State and ZIP Code)

CODE FACILITY CODE

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of offers is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning ______ copies of amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OR OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

Check One

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return _______ copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible)

Except as provided herein, all terms and conditions of the document referenced in item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR 16B. UNITED STATES OF AMERICA

(Signature of person authorized to sign)

15C. DATE SIGNED

(Signature of Contracting Officer)

16C. DATE SIGNED

Suzanne.Casey Typewritten Text X

Attachment Page

PAGE 2 OF 56 ED-ESE-17-R-0003/0001

The purpose of this amendment is to:

a) Extend the proposal due date for this requirement to reflect 11:00 am EST on Thursday December 22, 2016.

b) Incorporate the revised Performance Work Statement (PWS) and Appendix A (schedule of deliverables) that renumbers subtasks 2.1.6 - 2.1.8. No additional language was incorporated into the PWS.

c) Provide the Department’s response to clarification questions received at or before 11:00 am EST on Monday, November 21, 2016, which are provided below:

Business Questions

1. In the Management Plan subsection of the Instructions, it states the Conflict of Interest Certificate for all subcontractors/contractors should be "included in the technical proposal," but the Business Proposal volume has a section for the Offeror's Conflict of Interest Certificate and Plan. Can the Government please clarify in which volume the CoI certificates belong?

ED’s Response- Offerors are to include CoI certificates in only the business proposal and not the technical proposal.

2. Can volume headers and footers have a smaller font size than 12 point?

ED’s Response- Headers and footers shall have a font size of 12 or higher.

3. How many Past Performances does a Prime need to submit? How many Past Performances can a Prime’s subcontractors submit?

ED’s Response- It is up to offerors to determine how many past performances they would like to include in their proposal. There is no limit on the maximum number of past performances an offeror can include as part of the technical proposal.

4. (Section L pg. 43 Experience) How many Past Performances are required in the Experience section?

ED’s Response- It is up to offerors to determine how many past performance they would like to included in their proposal.

5. (Section L pg. 43 Experience) How old can the Past Performance reference be?

ED’s Response- Offerors are encouraged to use their most recent past performance report; however offerors can reference any past performance they would like to use.

6. (Section L pg. 43 Experience) Does the Offerer need to provide any Past Performance

Questionnaires?

ED’s Response- No.

PAGE 3 OF 56 ED-ESE-17-R-0003/0001

7. Can the Government provide historical FTEs for this effort?

ED’s Response- Under this solicitation, ED will not release the historical FTEs for this effort.

8. Will the government share the current level of effort on the contract, as well as the anticipated level of effort?

ED’s Response- The level of effort will not be provided for either of the scenarios requested above.

9. (Section L pg. 46 FTE Count) Would the Government consider providing a historical non-key FTE count by Task?

ED’s Response- ED historical non-key FTE count by Task will not be provided.

10. Criterion 2 for the Management Plan states "The extent to which the offeror’s proposed key personnel are available and are not committed to other projects." Can this Criterion be removed if the Offeror is not required to name a key personnel but can submit the duties of what the Key Personnel will perform in the Appendix but no name of that individual?

ED’s Response- The solicitation states that “The Project Director key personnel candidate must be known and submitted with the proposal;” therefore, this criterion will not be removed from the solicitation. Although offerors have the ability to include a position description for unknown key personnel (excluding the Project Director), it is recommended that offeror work to fill the roles with actual individuals in their proposal.

11. What is the primary location of the project? ( City and State) Also are the contract employees required to work on-site or is remote work allowed.

ED’s Response- The primary location of the project is Washington, D.C. While contract employees are not required to work on-site, they are required to attend bi-weekly status meetings in person at the LBJ Office Building.

12. (Section L pg. 41 Table of Contents) Does the Offerer need to include the author of the section in the Table of Contents?

ED’s Response- Yes, offeror’s shall include the author of each section in the Table of Contents.

13. (PWS pg. 28-29 Enhancements/Task 6) Will the $1,000,000 annual enhancement ceiling for OY1 through OY4 be considered Firm Fixed Price?

ED’s Response- Yes, each enhancement issued through task 6 will be negotiated prior to exercise and awarded as a firm fixed price enhancement. The amount of each enhancement may differ, based on the level of effort and expertise required for each enhancement; however ED will not exceed the $1,000,000 threshold for enhancements in each option year.

PAGE 4 OF 56 ED-ESE-17-R-0003/0001

14. (PWS pg. 28-29 Enhancements/Task 6) The RFP lists several examples of enhancements including but not limited to, system functionality, MSIX reports, State Profiles, Child Count, GPRA and Leading Indicator measures, user interface, backend application, responsive web design, system security, etc. Would the government consider providing a percentage estimate with respect to the $1,000,000 ceiling amount by the most utilized enhancements during contract execution?

ED’s Response- The enhancements that will be exercised under this award are unknown at this time, therefore the Department is unable to provide an estimate.

15. (Section L pg. 45 Summary Chart/Pricing Schedule) Would the Government consider issuing a cost proposal/pricing template for offeror submission?

ED’s Response- ED will not provide a cost/pricing template, however offerors are to include and address the information requested in the RFQ.

16. (Section L pg. 46 Payment Schedule) Please confirm that Task 6 will be excluded from the offeror’s payment schedule.

ED’s Response- An optional deliverable entitled “Optional Task 6 Enhancements” shall be included in offerors payment schedules with a $1 million dollar amount, so that offerors’ payment schedule reflect all proposed/potential costs included in this requirement.

17. The RFP states that the opportunity is unrestricted, but the FBO.gov cover page and the RFP SF 1449 lists the NAICS as 541511 – Custom Computer Programming Services. The Size Standard for NAICS 541511 is $27.5M. The size standard is the largest a concern can be to qualify. Is the NAICS correct for this opportunity?

ED’s Response-Yes, the NAICS code provided is the correct code. A size standard is the largest that a concern can be and still qualify as a small business for Federal Government programs. This requirement has been issued as a full and open competition, therefore both large and small businesses can propose on this requirement.

18. The RFP does not discuss inclusion of a cover letter where the offeror can accept the Terms and Conditions and sign to commit the company. Should the Cover Letter be included with the Business Proposal, Volume II or included as a separate attachment?

ED’s Response- The cover letter can be included in the business proposal.

19. (Page 30 52.239-70 ACCESS TO CONTRACTOR AND SUBCONTRACTOR INFORMATION SYSTEMS AND RELATED) Will the time spend by offeror's staff to support potential government required inspection be billable under this contract?

ED’s Response- No additional costs, besides the costs proposed by the offerors for the deliverables contained in the PWS will be provided under this contract.

PAGE 5 OF 56 ED-ESE-17-R-0003/0001

20. (Page 39 Submission Instructions) Appendix 2 should include letters of commitment from all proposed subcontractors, consultants, and key personnel not employed currently by the offeror.

Does this statement mean that letters of commitment are required for a)all proposed consultants and subcontractors and b)key staff not currently employed by the Offeror or only those proposed consultants and key staff all of which are not currently employed by the Offeror?

ED’s Response- Letters of commitments should be provided for all proposed subcontractors, consultants, and key personnel not employed currently by the offeror.

21. (Pages 39 – 40 Instructions to Offerors) The technical proposal shall be submitted in MS Word or searchable PDF format. Page 40: Offerors shall submit one technical volume and one business volume that is entitled with the offeror’s name and either (technical or business volume) in PDF format. Which submission format is correct?

ED’s Response- Offerors shall submit proposals in searchable PDF format. An excel sheet shall be provided by the offeror to reiterate the pricing information contained in the business proposal and contain documents such as the offeror’s payment schedule.

22. (Page 40 Submission Instructions) In addition, offerors are encouraged to provide a copy of their price buildup, payment schedule, etc. in Excel format. Is the Excel-format file additional detail not provided in the Business Proposal and intended to supplement the information, or a duplicate of the information provided in the Business Proposal?

ED’s Response- The information provided in the excel format should reiterate the pricing information contained in the business proposal and be a way to allow the Department to double check the offerors proposed pricing.

23. (Page 41 Technical Proposal Details) Resumes shall be included for all key staff for this contract, including key staff from subcontractors, and consultants. Does this statement mean that resumes are required for all consultants proposed, or all key staff that are consultants?

ED’s Response- Resumes for all key personnel are to be provided, therefore resumes should be submitted for consultants that are considered key personnel.

24. (Page 41 Technical Proposal Details) Resumes shall be included for all key staff for this contract, including key staff from subcontractors, and consultants. This conflicts with the Submission Instructions on page 39 which requires resumes to be included in Appendix 1. Please confirm whether resumes should be included in section 5 of the Technical Proposal, Appendix 1 of the Technical Proposal, or both locations.

ED’s Response- Resumes are to be included in Appendix 1 only.

25. (Page 42 Technical Proposal Details) A letter of commitment from all proposed consultants and key staff not currently employed by the Offeror should be included. This conflicts with the

PAGE 6 OF 56 ED-ESE-17-R-0003/0001

Submission Instructions on page 39 which requires letters of commitment to be included in Appendix 2. Please confirm whether letters of commitment should be included in section 5 of the Technical Proposal, Appendix 2 of the Technical Proposal, or both locations.

ED’s Response- Letters of Commitments are to be included in Appendix 2 only.

26. (Page 42 Technical Proposal Details) A letter of commitment from all proposed consultants and key staff not currently employed by the Offeror should be included. Does this statement mean that letters of commitment are required for a)all proposed consultants and b)key staff not currently employed by the Offeror or only those proposed consultants and key staff both of which are not currently employed by the Offeror?

ED’s Response- Letters of commitment are required from all personnel proposed by the offeror that do not currently work for the offeror.

27. (Page 42 Technical Proposal Details) A letter of commitment from all proposed consultants and key staff not currently employed by the Offeror should be included. This conflicts with the Submission Instructions on page 39 which includes all proposed subcontractors. Please clarify which types of resources are required to submit letters of commitment.

ED’s Response- Proposed key personnel that do not currently work for the offeror need to submit a letter of commitment. In addition, all proposed subcontractors need to submit letters of commitment.

28. (Page 45 Technical Proposal Details Alternative Approaches paragraph) Should the recommended alternative approaches be included within section 8 of the Technical Proposal or throughout the applicable sections of the Technical Proposal?

ED’s Response- If an offeror decides to submit an alternative approach, than the offeror should provide that approach in the appropriate section of their technical proposal.

Therefore no, alternative approaches should not be included in section 8. Please note that only one approach should be provided by the vendor.

29. (Page 45 Business Proposal) Any applicable markup or indirect cost applied to these non-labor costs should be included. The paragraph is addressing the requirements regarding personnel, hours and rates which are labor costs. Should the sentence in question read "Any applicable markup or indirect cost applied to these labor costs should be included"?

ED’s Response- The statement is referring to any other costs outside of labor rates and how any indirect costs should be provided by offerors.

30. (Page 46 Business Proposal Section 3 Pricing Table) Should the columns for Base Year through

Option Year 4 represent the hourly rate multiplied by the number of hours for each labor category?

ED’s Response- Yes. Please ensure that the hourly rate and the numbers of hours are provided in addition to the overall cost by position.

PAGE 7 OF 56 ED-ESE-17-R-0003/0001

31. (Page 46 Business Proposal Section 3 Pricing Table) If the number of hours for a given labor category is expected to change over time, should the table be revised to only include one option year and duplicated five times?

ED’s Response- The breakdown of labor categories and the hours assigned to them should be provided by year by task. Therefore each year should have an accurate accounting of what labor rates need what hours.

32. (Page 46 Business Proposal Pricing for Optional Tasks (excluding Task 6 Enhancements).

Complete pricing to include the identification of proposed labor categories by named individuals, their functional category, level of effort, effective hourly rate, extended labor price, other direct costs (including the identification of any applicable indirect cost and how it is applied to other direct costs), and profit/fee. Please define what a "functional category" and "extended labor price" are. Does "extended labor price" include application of indirect rates, or is it simply direct labor rate multiplied by hours?

ED’s Response- This statement means that you should provide a cost build for all optional tasks except for task 6.

33. (Page 46 Business Proposal) 8. Payment Schedule Are payments to be scheduled on a monthly basis based on estimated task progress/progress payments or on a milestone/task completion basis?

ED’s Response- As stated in the solicitation, “The payment schedule shall separate the payments for each deliverable by PWS task/subtask for the entire performance period.”.

Payments are to be made based on the completion of work (deliverables), as progress payments or payments based on time will not be made.

34. (Instructions to Offerors, Submission Instructions, Page 39) Do headings, table of contents and texts in tables and graphs need to be double-spaced? Also, the instruction stated that “Arial” may be used as an alternate font on tables and graphics. Is Arial Narrow font acceptable for table and graphic texts?

ED’s Response- The following items are the only items that do not have to be double spaced: for charts, graphs or tables. In addition, Arial Narrow font is considered to be an acceptable font as well.

35. (Instructions to Offerors, Submission Instructions, Page 40) Will the government consider extending the proposal due date given the holiday schedule and the extensive task requirements?

ED’s Response- Yes, the Department will extend the proposal due date to reflect December 22, 2016 at 11 a.m. eastern time.

36. (Instructions to Offerors, Technical Proposal Details, Number 7 Management Plan, Page 43)

PAGE 8 OF 56 ED-ESE-17-R-0003/0001

The Solicitation stated “Letters from proposed subcontractors/consultants indicating their willingness to serve, if selected, must be included in the Offeror’s proposal. All proposed contractors and subcontractors shall sign a Conflict of Interest Certificate, and this shall be included in the technical proposal submission.” Question: Where should these two documents be included in the proposal? Can it be included in another appendix outside of the 50 page limit for Technical Proposal?

ED’s Response- Letters of commitment should be included in Appendix 1 of the technical proposal and COI certificates should be included in the business proposal.

37. (Instructions to Offerors, Submission Instructions, Business Proposal, Page 46) We understand that all the requirements for submitting the Business Proposal are included in the solicitation.

However, for the pricing calculation is it the government’s intent that the offeror use their own template or is there a government template for use? If so, can the government provide the template?

ED’s Response- The Government does not have a template for offerors to use.

38. (Standard Form 14491 of RFP (Section 27a) Section 27a) “Solicitation incorporates by reference FAR 52.212-1, FAR 52.212-4. FAR 52.212-3 and FAR 52.212-5 are attached.” is not checked but to its right, a block is checked “(Addenda) are attached”. Please confirm whether Section 27a is incorporated.

ED’s Response- Section 27a is not incorporated. It was an error we encountered using our contracting system.

39. Submission Instructions / Technical Proposal Details 39 & 41 of RFP “In Appendix 1, the offeror shall include resumes for all key personnel.” & “Resumes shall be included for all key staff for this contract, including key staff from subcontractors, and consultants.” Please confirm that resumes should go in Appendix 1 and not Section 5: Personnel.

ED’s Response- That is correct resumes shall only be included in Appendix 1.

40. (Submission Instructions / Business Proposal 40 & 46 of RFP) “Offerors shall submit one technical volume and one business volume that is entitled with the offeror’s name and either (technical or business volume) in PDF format. In addition, offerors are encouraged to provide a copy of their price buildup, payment schedule, etc. in excel format.” & “The Offeror should submit an Excel (or MSWord with Excel imbedded table) version of the payment schedule, so that the Government can independently verify that the individual items sum to the correct total.” Pages 40 and 46 seem to contradict themselves. Embedding an Excel file in a Word doc and then converting to PDF will make the Excel uneditable. Please confirm the format for each volume of the RFP.

ED’s Response- Offerors shall submit searchable PDFs of their technical and business proposal and a supplemental excel sheet that reiterates the information contained in the offerors business proposal such as payment schedules, etc.

PAGE 9 OF 56 ED-ESE-17-R-0003/0001

41. (Technical Proposal Details 41 of RFP) "The proposal should include a Table of Contents as a means of quickly accessing important points of discussion in the proposal. The Table of Contents shall lists sections, subsections and page numbers, and identifies the author of each section."

Please confirm that the identification of authors refers to the specific individuals at the Subtask level who contributed to the document.

ED’s Response- The individual or individuals that write each section shall be identified in the table of contents.

42. (Technical Proposal Details 43 of RFP” “The offeror should describe its past and current experience in conducting projects of a similar or comparable nature as well as its experience with different federal programs.” Please confirm that this refers to between 3 past performance examples of similar size and complexity to MSIX.

ED’s Response- It is up to the offerors to submit as many past performances as they would like.

Technical Questions

43. (Task 2.2: IT Systems Security Task 7: System Migration to a FedRAMP CSP 65 - 67 of RFP 29 of

RFP) Various For the purposes of scheduling and costing, what is the expected duration of the full ATO recertification activities associated with a migration to a FedRAMP Certified CSP? Please confirm that these activities must be complete prior to the execution of the migration from the existing MSIX environment to a FedRAMP Certified CSP.

ED’s Response- As stated in Task 7, the timeline is targeted for 45 days. Within those 45 days the contractor is responsible for working with the Department’s Information Security Team to assess agency responsible controls. The Department deems this timeframe to be sufficient for a FIPS 199 Low categorization system moving from the existing IaaS service provider to a FedRAMP certified IaaS solution.

44. (Task 2.2: IT Systems Security 66 of RFP The Contractor, and all subcontractors, shall allow Department employees (or Department designated third party Contractors) access to the hosting facility to conduct C&A/SA activities to include control reviews in accordance with the current revision of NIST SP 800-53 and NIST SP 800-53A. Does the department require access to the FedRAMP certified CSP’s hosting facility to conduct C&A/SA activities?

ED’s Response- No, the Department does not require access to the FedRAMP certified CSP’s hosting facility to conduct C&A/SA activities.

45. (Task 3.1.1: Help Desk Management 69 of RFP 21 of PWS) “The COR may assign additional tasks related to routine tasks as circumstances warrant.” Please confirm the types of tasks / activities this may include to better inform pricing determinations.

PAGE 10 OF 56 ED-ESE-17-R-0003/0001

ED’s Response- Any tasks that the COR may assign are inherently within scope of the contract tasks as stated in the following three bullet items listed in the PWS and should not affect any pricing determinations by the contractor:

• The COR will provide guidance to the Project Manager (PM), and coordinate with the PM and staff regarding the scheduling, performance, and reporting of assigned tasks. The COR may assign additional tasks related to routine tasks as circumstances warrant. (Task 1)

• The Contractor shall ensure that staff is appropriately scheduled to perform on-site help desk and trouble ticket management tasks, between the hours of 9:30 AM to 6:30 PM Eastern Standard Time, Monday through Friday, excluding Federal holidays. (Task 3)

• The Contractor shall also ensure that staff is scheduled and available to work on Priority One problems (i.e. system crash, on-call support) at any time. (Task 2)

46. (Task 3.1.1: Help Desk Management 69 of RFP 21 of PWS) “The Contractor shall ensure that staff is appropriately scheduled to perform on-site help desk” Please confirm that on-site help desk staff is defined as the contractor office.

ED’s Response- On-site help desk staff is defined as the contractor office.

47. (Task 5.2.2: GPRA Reports 76 of RFP) 5. National Efficiency Measure – TBD The amount of funding allocated to states per student success. Please confirm that the text provided for GPRS Measure 5 is in draft form. How is OME defining “student success?”

ED’s Response- GPRA Measure 5 is in draft format. At this point in time, OME has not determined the measure of “student success” through MSIX.

48. (Task 3.2 23 of RFP) Provides up to 4 annual in-person briefings/trainings to include MSIX orientation/training sessions as specified (i.e., as a component of MEP meetings, national conference, or ED sponsored annual meetings.) The Contractor will not be responsible for hosting these meetings, but rather provides training and/or technical assistance related to MSIX.

Please confirm that the 4 annual in-person briefings/trainings do not require travel outside of Greater Washington Area.

ED’s Response- The same response as question 80: The PWS specifies the following:

“Provides up to 4 annual in-person briefings/trainings to include MSIX orientation/training sessions as specified (i.e., as a component of MEP meetings, national conference, or ED-sponsored annual meetings.) The Contractor will not be responsible for hosting these meetings, but rather provides training and/or technical assistance related to MSIX.” The briefings may be held in a series of different locations, i.e., Department of Education in Washington, D.C. and various sites throughout the nation. For planning purposes, the MSIX contractors usually present at the Department of Education for two of the briefings. Other locations for

PAGE 11 OF 56 ED-ESE-17-R-0003/0001

briefings/trainings have been Clearwater, Florida; San Diego, California; Seattle, Washington;

and San Antonio, Texas. It will vary from year to year.

49. (Attachment A, PWS, General) Is there a current backlog of requirements or defects? If so, how large is the backlog?

ED’s Response- There are approximately 93 changes and 111 defects in the current backlog.

50. (Attachment A, PWS, Purpose and Scope) Can the government provide a list of the states that are new to this program? Can the government also clarify if there is a current plan in place to ingest new states migrant students’ data?

ED’s Response- There are 46 states that currently operate a Migrant Education Program (MEP) and are currently submitting data to MSIX. Wyoming, West Virginia, Connecticut and Rhode Island do not operate a MEP. If any of the four states decide to operate a MEP in the future, the contractor would work with the state(s) to certify its/their data.

51. (Attachment A, PWS, Task 2.2: IT Systems Security, Page 65 of 172) IT Systems Security. The 2nd paragraph states that these security requirements include, but are not limited to, the successful Certification and Accreditation (C&A) or Security Authorization (SA) of the system (includes commercially owned and operated systems managed by the commercial vendor and its subcontractors, supporting Department programs, contracts, and projects).

Question: Who is responsible for performing the Certification and Accreditation or Security Authorization?

ED’s Response- The Department’s Information Assurance Team is responsible for conducting the Security Authorization. The Contractor is responsible for the design, documentation and implementation of all agency responsible security controls consistent with the current revision of NIST SP 800-53, the FedRAMP certified System Security Plan and all other security related activities described in the PWS.

52. (Attachment A,PWS, Task 7 System Migration to a FedRAMP CSP, Page 77 of 172 Task 7) System

Migration to a FedRAMP CSP. Are MSIX’s applications currently on a FedRAMP CSP? Our understanding of the scope of this effort is to transition from an existing to a potentially new CSP. Please confirm if this understanding is correct.

ED’s Response- The MSIX applications are not currently on a FedRAMP certified Cloud Service Provider (CSP). MSIX production, development, and testing servers are hosted by Hewlett Packard in Orlando, Florida. The scope of this contract entails moving the MSIX applications to a CSP that is FedRAMP certified.

53. (Attachment A, PWS, Page 77) Can the government provide the name of current FedRAMP CSP provider?

PAGE 12 OF 56 ED-ESE-17-R-0003/0001

ED’s Response- MSIX is currently hosted by a private cloud solution with plans to migrate the system to a FedRAMP certified Cloud Service Provider (CSP) with the FY17 contract.

54. (PWS pg. 29 Task 7) Is there any plan for MSIX to be hosted by EDUCATE (or the future PIVOT) support team? Is the MSIX team amenable to having the application hosted in this environment?

ED’s Response- There is no plan for MSIX to be hosted by EDUCATE (or the future PIVOT) support team. The MSIX application is defined by statute and cannot be hosted in that type of an environment.

55. (PWS pg. 92) Assumptions “1. The as-deployed MSIX Contractor development project team

2. The as-deployed MSIX Contractor Application Management Services (AMS) organization

3. The Ed

4. The 3rd party How is 1 different from 2; why there is un certainty for any of the above for transition-out?"

ED’s Response- The current contractor’s Phase-Out Plan accounts for various administrative roles/responsibilities that may or may not be in place at the time of an MSIX phase-out by the current contractor.

56. (PWS pg. 60 "2.1.1 4th bullet) "Does MSIX have an interface/web service contract with the

States or States obligated to make necessary changes based on MOU signed? What are MSIX contractor responsibilities with respect to states data changes for ingestion, inbound changes to MSIX consolidated replica or outbound changes to states source systems as well? What’s LOE? Is it assessed and charged to state(s)?

ED’s Response- MSIX does not have an interface/web services contract with the States that employ web services. States are obligated to make updates when necessary as outlined in the web services documentation. MSIX contractor has the responsibility to communicate and assist the States in understanding the file format specifications. The contractor has no financial responsibility with respect to states’ data changes for ingestion or inbound changes. Contractor has the responsibility to send files that do not conform to MSIX specifications back to the States as per the MSIX Data Quality Reports. LOE refers to Level of Effort, and there is no LOE with respect to the states’ making changes.

57. (Instructions to Offerors, Submission Instructions, Page 39) The Solicitation stated “The Project

Director key personnel candidate must be known and submitted with the proposal.”

Question: Can the government clarify if the role of Project Director is to provide corporate management oversight? Additionally, can the government provide description of qualification requirements for Project Director?

ED’s Response- To clarify, the role of the Project Director is to provide oversight of all aspects of the MSIX project in terms of the contract; not in terms of corporate management

PAGE 13 OF 56 ED-ESE-17-R-0003/0001

oversight. Please refer to #5 – Personnel in the Instruction to Offerors. “The Offeror shall propose a team with appropriate knowledge, skills and abilities to support Department’s goals and objectives for this initiative. The proposal shall describe in detail the qualifications of key personnel, detailing their competencies and experience in performing work of similar size and scope to that outlined in the PWS, and describing their role in the project. The Offeror’s selected staff must possess knowledge and skills in the following areas: System Development Life Cycle (SDLC), system integration, information assurance/cybersecurity standards, procedures, and related federal policies, risk management, database management, Responsive Web Design (RWD), web technologies, cloud computing, quality assurance and compliance;

customer satisfaction, process re-engineering strategic planning, and project management.”

The Instruction to Offerors provides the following requirements for the Project Director as evident in the candidate’s resume:

• Ability to obtain federal clearance at the 5C level or equivalent

• Experience in project management

• Experience in designing, developing and maintaining of computer systems and databases

• Experience with scheduling and budgeting

• Strong leadership, organization and communication skills.

58. (PWS pg. 65 Subtask 2.2) What’s current FISMA categorization for MSIX? Low/Moderate/High?

ED’s Response- The current FISMA categorization for MSIX is Low.

59. (PWS pg. 71 Subtask 3.2) How often training data needs to be refreshed? Any product/tool/feature being used to scrub data to make it Non-PII?

ED’s Response- Training data is refreshed prior to each training event. It is unknown what product/tool/feature is used, if any, by the contractor to manipulate data to make it non-

PII.

60. (PWS pg. 74 Subtask 5.10) Tableau is considered outside of GFE?

ED’s Response- Please refer to Appendix G – Government Furnished Property. There are

5 licenses to Tableau Desktop Pro whose yearly licenses are to be purchased and maintained by the contractor on behalf of the government.

61. (PWS pg. 76 Task 6) Who are primary users of Tableau?

ED’s Response-The primary users of Tableau are the MSIX contractors and government staff.

62. (PWS pg. 77 Task 7) Who is authority of approval or decision maker for enhancements through Option Years? What drives such enhancements excluding enablement of emerging technologies for optimized services.

a. Other When such transition of on premise/GFE hosting to off-premise or one hosting provider to another – often there is big impact on software assets licensing? Is there any

PAGE 14 OF 56 ED-ESE-17-R-0003/0001

analysis or cloud readiness assessment done? If not, timelines are aggressive and risky value proposition to make such call?

ED’s Response- Enhancements through option years are to be taken from items that have been approved by the MSIX Change Control Board (CCB) and that have been discussed by the MSIX Team and approved by the MSIX COR. Enhancements are predominantly driven by business needs and impact to the user community. A Cloud migration assessment has been done. Availability of funds, prioritization of system functionality needs, prioritization of user requests, and other government needs all contribute to the decision making process.

63. (General) Where is the place of performance for this project?

ED’s Response – The place of performance for this project is not specified in the contract. However it is important to note that key personnel must be present on a bi-weekly basis to attend MSIX status meetings.

64. (Appendix B Resumes) AMPM seems to be a Deloitte specific COTS product. Please define what specific data is stored by this system?

ED’s Response- AMPM is used to capture and manage all details associated with trouble tickets, incidents and change requests throughout the lifecycle.

65. (PWS Pg. 64 Subtask 2.1.6) What tool is currently used for Asset Management?

ED’s Response- Microsoft Excel.

66. (PWS pg. 64 Subtask 2.1.7) "“The Contractor may continue operation at the Alpharetta Data

Center facility or choose another location.” Is DR migration required? Will resources need to be onsite at the data center or can all administration support be conducted remotely?"

ED’s Response- If the contractor chooses not to continue operation at the Alpharetta Data Center facility, the contractor is responsible for the cost associated with moving the disaster recovery site. The Contractor shall provide the labor and materials necessary to maintain full certification and continued accreditation of the separate facility and the full replication of the production site – including the loading of live data-- at this separate facility.

MSIX administration can be conducted remotely.

67. (PWS pg. 65 Task 2.2) What are the current tools used to maintain security (scanning, etc.)?

ED’s Response- All security controls and POA&Ms are maintained using the Cyber Security Assessment and Management (CSAM) tool. Nessus is used for vulnerability scanning.

68. (PWS pg. 70 Task 3.2) What platform is used for conducting online training?

ED’s Response- The online training currently consists of training modules that have been built using Adobe Captivate.

PAGE 15 OF 56 ED-ESE-17-R-0003/0001

69. (PWS Pg. 72 Task 7) Can the government share the annual budget for cloud hosting services?

How much the government current spend on hosting for production and DR?

ED’s Response- The government will not share the annual budget for cloud hosting services.

70. (PWS Pg. 77 Task 8) What tool is the government currently using for generating reports (canned, ad hoc)?

ED’s Response- Currently MSIX uses Adobe Flex for generating reports.

71. Will a technical data room be available to review program technical documents?

ED’s Response- There will not be a technical data room available to review program technical documents.

72. (Page 58 Task 2.1) "How many different reports are developed on top of the database?

ED’s Response- There are approximately 20 reports on the MSIX application developed with Adobe Flex.

73. How many user interface screens are developed for this system? " ED’s Response- Please refer to Appendices C and D, MSIX User Manual and Reports

Manual for an indication of the number of interface screens in the system.

74. (Page 59 Subtask 2.1.1) How many states are completely integrated in the MSIX system? How many are in the process?

ED’s Response- All 46 states are currently integrated into the MSIX system, although not all States are submitting all of the required minimum data elements (MDEs) at this point in time.

75. (Page 59 Subtask 2.1.1) Will the government share the existing Web Services Onboarding document mentioned in the deliverables list in subtask 2.1.1?

ED’s Response- The Web Services Onboarding document referenced in the deliverable list in subtask 2.1.1 contains sensitive information and cannot be shared. All relevant information for public release has been provided in the solicitation.

76. (Page 61 Subtask 2.1.3) How many outstanding issues or system bugs have been detected but not completely resolved in the system?

ED’s Response- There are approximately 111 defects in the current backlog.

77. (Page 62 Subtask 2.1.3) Monitor network and system management software for problems, outages, alerts and anomalies affecting the infrastructure, during normal and extended working hours. Can the government elaborate on the statement? What are the extended working hours?

PAGE 16 OF 56 ED-ESE-17-R-0003/0001

ED’s Response- The phrase “during normal and extended working hours” means that the contractor is responsible for 24x7x365 monitoring of network and system management software for problems, outages, alerts and anomalies affecting the MSIX infrastructure.

78. (Pages 63 - 64 Subtask 2.1.6 ) Tasks list Subtask 2.1.6 as Equipment and Subtask 2.1.6 as Asset Management. The numbering format needs to be revised to ensure the offeror can respond without confusion.

ED’s Response- The PWS will be renumbered to reflect Equipment as Subtask 2.1.6, Asset Management as Subtask 2.1.7 and Disaster Recovery as Subtask 2.1.8.

79. (Page 68 Task 3.1) Can DoED make the current "Help Desk Operation Manual" for the MSIX system available to provide better understanding of the help desk operations for level-of-effort estimation purpose?

ED’s Response- The Help Desk Operation Manual contains sensitive as well as contractor specific information and therefore cannot be shared. It is the government’s opinion that the manual is not necessary for level of effort estimation purposes.

80. (Page 71 Task 3.2) Provides up to 4 annual in-person briefings/trainings to include MSIX orientation/training sessions as specified. Where will the in-person briefings/trainings be held?

ED’s Response- The same response as question 48. The PWS specifies the following:

“Provides up to 4 annual in-person briefings/trainings to include MSIX orientation/training sessions as specified (i.e., as a component of MEP meetings, national conference, or ED-sponsored annual meetings.) The Contractor will not be responsible for hosting these meetings, but rather provides training and/or technical assistance related to MSIX.” The briefings may be held in a series of different locations, i.e., Department of Education in Washington, D.C. and various sites throughout the nation. For planning purposes, the MSIX contractors usually present at the Department of Education for two of the briefings. Other locations for briefings/trainings have been Clearwater, Florida; San Diego, California; Seattle, Washington;

and San Antonio, Texas. It will vary from year to year.

81. (Page 71 Task 3.2) Operate and maintain a separate training environment from the production facility. Currently, MSIX production, development, and testing servers are hosted by Hewlett Packard in Orlando, Florida. Is travel to Orlando, Florida required and if so, how frequently is travel anticipated to be required?

ED’s Response- Please refer to Task 7 of the PWS regarding cloud migration. The contractor will be migrating MSIX production, development and testing servers to a Cloud Service Provider (CSP) that must be FedRAMP Certified and have been issued a FedRAMP-compliant Authority to Operate (ATO) that has been verified by the FedRAMP Project Management Office (PMO). For that reason, the MSIX servers will no longer be located in Orlando, FL.

PAGE 17 OF 56 ED-ESE-17-R-0003/0001

82. (Page 77 Task 7) Did the DoED or existing contractor perform a system readiness review for moving the MSIX system to a cloud environment? If not, then is 45 days from contract award necessary to complete full system transition analysis and execution?

ED’s Response- A Cloud Migration Analysis is currently being conducted, and is not available at this point in time. 45 calendar days from contract award should be sufficient to complete the migration process.

83. (Page 77 Task 7) The migration shall include performing an equipment (e.g. software, certificates, etc.) refresh within 90 calendar days after contract award in accordance with the approved equipment phase-in plan. Will the government elaborate? Is the government looking for a private cloud solution?

ED’s Response- The Phase-In Plan should account for all tasks within the solicitation.

As stated in Task 1.2 subtask 1.2.1, the Phase-In Plan includes environment transition and conducting an inventory. As a result of these activities, identification of equipment needing refresh (possibly retire or replace) is expected to occur (see subtask 2.1.6 for types of equipment to be evaluated for refresh needs). The offeror is expected to provide an updated Phase-In Plan to account for the activities associated with completing Task 7. An equipment refresh is expected to be performed as a part of Task 7 and should be completed within 90 days after contract award, as stated in Task 7.

System (Cloud) Migration Plan may be a section in the larger Phase-in Plan or a stand-alone plan referenced in sufficient detail in the Phase-In Plan. The Government is not looking for a private cloud solution. Please note, that transition-in, equipment phase-in and phase-in have been used interchangeably in Task 7.

84. (Page 103 4.0 Environment Transition Plan) Will the contractor need to account for the infrastructure environment and disaster recover hosting charges?

ED’s Response- Yes.

85. (Page 160 Appendix G) "Will the government confirm that hardware, software, licenses, certificates and maintenance contracts for MSIX environment will be Government furnished?

ED’s Response- Appendix G lists the Government Owned Property related to MSIX. The contractor is responsible for obtaining and purchasing the annual licenses and support on behalf of the government. Please refer to the last column on the right under Comment heading.

86. Will the government list all tools, if any, to be government furnished, such as ticketing system, Change Management tool, Software Configuration tool, Risk Repository tool, Work Request System?"

ED’s Response- Appendices F and G list everything that is government furnished.

PAGE 18 OF 56 ED-ESE-17-R-0003/0001

87. Due to the criticality of this project, we recommend that CMMI Level 3 be added as a requirement to ensure that the chosen vendor has the required capability to meet the demands of this project.

ED’s Response- The offeror may provide information regarding their certification and attainment of industry recognized standards as a part of their technical proposal for the Department’s consideration.

88. Do all states submit data to MSIX in the same format? If the answer is no, how many distinct file formats are there?

ED’s Response- There are two different file formats – flat file and XML. The process for States’ submission of data is as follows:

The MSIX Inbound File Transmission process begins with the State End Users tracking Minimum Data Elements (MDEs) in their current MEP System. The source MDE is mapped to the target MDE counterparts by using the MDE Mapping Template in conjunction with the XML Specification or the Flat File Specification to produce MDE extraction code. The resulting extraction code creates a file that is transferred to the appropriate MSIX File Transfer Protocol (FTP) server – either Secure Shell (SSH) FTP (sFTP) or FTP Secure Socket Layer (SSL) (FTPs) – based on the State’s configuration, where the file will be housed until the MSIX data procurement process runs and delivers the data to the MSIX staging table. Upon record validation, an email notification is generated and sent back to the State Data Administrator.

89. How many outbound files were generated by MSIX in the prior fiscal year?

ED’s Response- An Outbound File Response is generated by MSIX when an inbound file is received and processed. The MSIX database server generates a request to the email server, in addition to generating a response file in either XML or pipe (“|”) delimited text format. The email message that is generated states the confirmation of receipt, as well as the response file location on the appropriate MSIX FTP server – either sFTP or FTPs – based on the State’s configuration. This file contains processing details such as the records updated, inserted, and those in error. The designated state user then accesses the email message and downloads the response file from the appropriate MSIX FTP server and makes any adjustments to the original file sent, if necessary. Although the exact number of outbound files generated by MSIX in the prior fiscal year is not known, the goal is to have all 46 states upload files nightly, 365 days per year = 365 days/year x 46 States = 16,790 outbound files.

90. Can you provide the XML Schema Definition (XSD) referenced in the MSIX Frequently Asked

Questions appendix?

ED’s Response-Because this document contains sensitive information the XML Schema

Documentation cannot be made available through the Q&A document.

91. Throughout the RFP Task areas, there are several references where the contractor will be required to either create or develop documents. Can the government provide more clarity and

PAGE 19 OF 56 ED-ESE-17-R-0003/0001

distinguish between the two requirements? (example: The Contractor shall develop and update; The Contractor shall create and update)

ED’s Response- The words “create” and “develop” have been used interchangeably in the PWS, however if the PWS states the contractor shall update, than it means the contractor will not be either creating or developing something.

PAGE 20 OF 56 ED-ESE-17-R-0003/0001

MIGRANT STUDENT

INFORMATION

EXCHANGE (MSIX)

DEVELOPMENT AND

MAINTENANCE

Attachment A: Performance Work Statement

ABSTRACT

Contractor support services to perform operations, development, and maintenance efforts to support the Migrant Student Information Exchange (MSIX) of Title I, Part C, Migrant Education Programs (MEP).

12/01/16

PAGE 21 OF 56 ED-ESE-17-R-0003/0001

Table of Contents

Background

Purpose and Scope

Objectives and Tasks

Task 1: Contract/Project Administration

Task 1.1: Kick-off Meeting

Task 1.2: Phase-In and Phase-Out Periods

Subtask 1.2.1: Phase-In (Base Year Only)

Subtask 1.2.2: Prepare and Update Phase-Out Plan

Subtask 1.2.3: Execute Phase-Out Plan (Optional Task)

Task 1.3: Project Management Support

Task 2: MSIX Operation

Task 2.1: MSIX…