Draft_PWS.pdf

MIGRANT STUDENT

INFORMATION

EXCHANGE (MSIX)

DEVELOPMENT AND

MAINTENANCE

Attachment A: Performance Work Statement

ABSTRACT

Contractor support services to perform operations, development, and maintenance efforts to support the Migrant Student Information Exchange (MSIX) of Title I, Part C, Migrant Education Programs (MEP).

10/18/16

Table of Contents Background

Purpose and Scope

Objectives and Tasks

Task 1: Contract/Project Administration

Task 1.1: Kick-off Meeting

Task 1.2: Transition-In and Transition-Out Periods

Subtask 1.2.1: Transition-In (Base Year Only)

Subtask 1.2.2: Prepare and Update Transition-Out Plan

Subtask 1.2.3: Execute Transition-Out Plan (OPTIONAL)

Task 1.3: Project Management Support

Task 2: MSIX Operation

Task 2.1: MSIX Administration

Subtask 2.1.1: System Interconnection and Data Ingestion

Subtask 2.1.2: Web Site Administration

Subtask 2.1.3: Fault Problem Detection, Documentation, and Resolution

Subtask 2.1.4: Testing

Subtask 2.1.5: Internet Protocol version 6 (IPv6)

Subtask 2.1.6: Equipment

Subtask 2.1.6: Asset Management

Subtask 2.1.7: Disaster Recovery

Subtask 2.1.8: Ad-hoc/Emergency Support

Task 2.2: IT Systems Security

Sub Task 2.2.1: FISMA Management and Reporting Tools

Sub Task 2.2.2: Reporting of Data Security Breaches ............................ Error! Bookmark not defined.

Task 2.3: Compliance with Privacy Policy .................................................. Error! Bookmark not defined.

Task 2.4: Compliance with Section 508 of the Rehabilitation Act ............. Error! Bookmark not defined.

Task 2.5: MSIX Documentation

Task 2.6: Documentation Quality

Task 3: Customer Support

Task 3.1: Help Desk Support and Trouble Ticket Management

Subtask 3.1.1: Help Desk Management

Subtask 3.1.2: Problem Resolution and Trouble Ticket Management

Subtask 3.1.3: Account Management

Task 3.2: MSIX Training and User Support

Task 3.3: Facilitate Communication between Stakeholders

Subtask 3.3.1: Communications Plan

Subtask 3.3.1: Records Exchange Listserv ............................................. Error! Bookmark not defined.

Subtask 3.3.1: State User Group for Analysis and Recommendations (SUGAR)

Task 4: Data Quality (Optional)

Task 4.1: Data Analysis, Remediation plan, and State Engagement

Task 4.2: Child Count Reconciliation

Task 5: Business Intelligence and Analytics

Task 5.1: License and Software Support

Task 5.2: Reports and Software Support

Subtask 5.2.1: State Profiles

Subtask 5.2.1: Government Performance and Results Act (GPRA) Reports

Task 6: Enhancements (Optional)

Task 7: System Migration to a FedRAMP Certified Cloud Service Provider (CSP)

Task 8: Reports Modernization (RWD) (Optional Task)

Background The educational needs of migratory children present unique challenges for educators and our Nation’s schools. Given the nature of their employment, migratory workers and their families often settle in a single community for a short period of time. One consequence of this mobile lifestyle is that migratory children frequently enroll in new schools and school districts without adequate, and in many cases any, documentation of their educational and health history. School staff at all levels need basic enrollment data, and typically proof of immunizations, to place students in the correct grade or course in a timely manner. Migrant educators have stressed that students in secondary grades have the greatest need for the timely exchange of records because they have limited time to correct mistakes that school officials make if they lack information needed for proper grade placement, course selection, and accrual of course credits required for high school graduation. Because migratory children may move at any time, including during the summer term when many schools are closed, it is imperative to have a reliable system with which the state education agency (SEA), local education agency (LEA), and local operating agency (LOA) staff may access up-to-date educational and health information for migratory children in a timely manner. Migrant Education Programs (MEPs) operate throughout the year, including during the summer; having timely access to a migratory child’s educational and health information help ensure that MEPs can provide migratory children with services that appropriately address their unique needs.

The Migrant Student Information Exchange (MSIX) helps meet the needs of migratory children by making current educational and health information on those children immediately available to school and program staff where migratory children enroll after they move. MSIX uses the Minimum Data Elements (MDEs) to provide a standard format for information that States must collect and maintain.

MSIX allows SEAs to upload the required MDEs from their own existing State student record systems into a single data repository where information on each migratory child is maintained, organized, and compiled. As a Web-based platform, MSIX allows authorized users to access a migratory child’s MSIX record via a Web browser.

MSIX, a major information technology (IT) major investment for the Office of Elementary and Secondary Education, supports the exchange of migrant student records from one school district to another as migrant students move within State or across State lines. This investment is in response to the Congressional mandate in Section 1308(b) of Elementary and Secondary Education Act of 1965 (ESEA), as amended. Section 1308(b) requires the Secretary to assist States in developing effective methods for electronically exchanging student records amongst States; and, to determine, and accurately account for, the number of migratory children in each State. The MSIX investment consists of a responsive web-based platform that links States’ migrant student record databases to facilitate the national exchange of migrant students’ educational and health information. The investment also involves an independent verification and validation (IV&V) effort to ensure correctness and quality of the design, development, and operation of MSIX and related deliverables.

The investment has four goals. These goals include exchanging education and health data; promoting the use of MSIX; ensuring the utilization of the consolidated records for enrollment, placement, and credit accrual, as well as producing national data on the migrant population. The primary beneficiaries of MSIX investments are the migrant students and State Migrant Education Program (MEP) grantees.

Migrant students benefit from educational records transferred in a timely and accurate manner;

available educational records enable students to be quickly enrolled in the correct grade or course or have their secondary course credits accrued towards graduation. MSIX also benefits MEPs by providing data and reporting capabilities on the migrant student population, which supports strategic planning and delivery of migrant education services.

The enterprise architecture roadmap includes implementing a responsive web design (RWD) and migrating MSIX system components into a FedRAMP certified cloud environment. MSIX will continue achieving programmatic and technical innovation through technical and system enhancements deployed during each upcoming fiscal year. The technical and system enhancements are consistent with the requirements of the program office, system security, and emerging technologies.

MSIX was developed as the most cost-effective method to address the exchange of migrant student records between and amongst States. If MSIX was not in existence, each State would be left to enhance their migrant specific database to allow for the national exchange of migrant student records.

Nevertheless, State uses disparate systems affecting their ability to transfer records at a national level.

Furthermore, there would be no national standard for migrant data exchange. Not having a national standard will adversely affect the completeness, logic, and validity of the migrant education data.

MSIX provides a national migrant record exchange platform providing benefit to internal and external stakeholders. Internal stakeholders include members of the Office of Migrant Education (OME) who can use MSIX to produce national data on the migrant population. External stakeholders encompass State MEP personnel and migrant families. States MEPs can use MSIX to facilitate enrollment, placement, and credit accrual, as well as to produce state-level data on the migrant student population to support strategic planning and service delivery. Migrant families benefit from this investment, having migrant student records transferred in a timely and accurate manner as they move between and amongst States, which in turn, improves their educational opportunities and academic success.

Purpose and Scope MSIX includes the linkage of 46 States’ migrant student systems for facilitating the national exchange of migrant student’s records including demographic, educational, and health information for Kindergarten

– grade 12 students, as well as high-school aged out-of-school youth. MSIX is built upon Oracle’s COTS 11g Enterprise Edition platform, which utilizes a Relational Database Management System (RDBMS) in conjunction with a suite of applications. Some of these applications include Oracle Internet Directory (OID), which serves as a Lightweight Directory Access Protocol (LDAP), Oracle Discoverer, and Oracle Workflow. Also, MSIX uses eScholar’s Uniq-ID student matching engine to identify students individually.

MSIX uses this state-supplied data to develop a consolidated migrant student record for each migrant student and provides views of each migrant student’s educational and health record to authorized MSIX users.

Because MSIX is a comprehensive technology platform and a major investment for the Department, the scope encompasses Contractor support to provide Project Management, System Operations, Cyber Security Management, Customer Support Help Desk, Issue Tracking and Trouble Ticket Management, Asset Management, State Support and Technical Assistance for MSIX. The MSIX Contractor must provide overall program oversight, analysis, and recommendations to the Department to ensure the quality of the design, development, and operation of MSIX and related deliverables through the Lifecycle Management (LCM) of the program.

In meeting these goals, the MSIX Contractor shall:

a) Ensure the MSIX remains fully functional and stable (e.g. bug-fixes, security upgrades, software patches), and complete all required system, hardware and software upgrades in a timely manner. Note: all upgrades or enhancements shall be coordinated with the Department.

b) Interface daily with users and other MSIX personnel via the MSIX Help Desk, which will be off-site and used to maintain a high quality of support for MSIX. Responsibilities shall include system usage training for users, and rapid response to all technical problems reported to the Contractor by users or by MSIX staff.

c) Be expected to install and maintain all MSIX software and hardware components and keep track of them via an automated reporting and tracking tool (Note: The Contractor should include the tracking tool in the proposal and describe its features and functionality.)

d) Perform Help Desk Support & Trouble Ticket Management tasks required to meet expected service levels and to support the end users of the MSIX.

e) Meet related system security and privacy requirements.

f) Support the Department’s initiated MSIX staff training initiatives.

g) Adhere to all Federal Government, Department of Education regulations, directives and standards related to the Clinger-Cohen Act of 1996, Federal Information Security Modernization Act (FISMA), Privacy Act, Paperwork Reduction Act (PRA), Office of Management and Budget (OMB) Circulars A-130 and A-123, among other applicable policies.

Objectives and Tasks The objective of MSIX is to provide a successful electronic system for linking existing State migrant student record systems and electronically exchanging timely and relevant migrant student records to benefit migrant students nationwide. The ability to transfer migrant student records efficiently facilitates the timely enrollment and placement of migrant students by providing better access to basic school enrollment information. An efficient records exchange system benefits highly mobile secondary migrant students by providing and maintaining course credit accrual information necessary for high school graduation.

The following overarching objectives are mandated to be accomplished under this contract.

1. Obtain under a performance-based arrangement, highly reliable and secure IT managed services and support that meets or exceeds customer requirements and expectations.

2. Establish a partner-focused working relationship with Government.

3. Throughout the life of this effort, demonstrate improved performance, reliability, security, and reduced cost of operating MSIX.

4. Given the dynamics of the IT environment, establish a work order arrangement that easily accommodates change (i.e., implement new and innovative technologies).

5. Develop and implement operation and maintenance services that support the Department’s compliance with Government standards, OMB reporting and Federal requirements [e.g., all Federal Government directives and standards related to the Clinger-Cohen Act of 1996, FISMA, Privacy Act, PRA, OMB Circulars A-130 and A-123, NIST) Special Publications (SP), and Federal Information Processing Standard (FIPS), among other applicable policies.]

6. Provide a partnership with team members and subcontractors that appear seamless to the Government and that fosters shared accountability and responsibility among all partners.

7. Provide timely services to enable OME and MSIX to meet its mission-critical requirements with system down times being as short as possible.

Task 1: Contract/Project Administration

Task 1.1: Kick-off Meeting Within five (5) calendar days of contract award, of all contract periods, the MSIX Contractor shall conduct a kickoff meeting with the Government to discuss contract objectives and timelines. The MSIX Contractor shall conduct the kickoff meeting at the Department headquarters in Washington, D.C. The MSIX Contractor shall provide the meeting agenda and any meeting artifacts (including the initial project plan and timeline, and subsequent meeting minutes).

Deliverable(s) The contractor shall create the following documents:

• Kick-off Meeting Agenda (Annual)

• Kick-off Meeting Artifacts(Annual)

• Kick-off Meeting Notes (Annual)

Task 1.2: Phase-In and Phase-Out Periods The MSIX Contractor shall develop comprehensive procedures for the phase-in and phase-out of the project and within the time allowed under the terms of this contract. The MSIX Contractor's phase-in and phase-out procedures shall not disrupt or adversely impact the day-to-day conduct of Government business.

Subtask 1.2.1: Phase-In (Base Year Only) During the phase-in period in the base year, the MSIX Contractor shall prepare to assume full responsibility for all areas of operation in accordance with the terms and conditions of this contract.

The MSIX Contractor shall submit a 45 day Phase-In Plan to include the bullet points below as well as a description of how all the actions outlined in Task 1 will be initiated and completed. The Plan shall finalize the MSIX Contractor’s efforts to affect a smooth and orderly implementation of contract responsibility.

During the 45 day phase-in period, the Contractor shall, at a minimum:

1. Describe procedures for environment transition as outlined in existing contractor’s Phase-Out Plan

2. Obtain all required certifications, licenses, permits, and clearances, including personnel security clearances, if applicable

3. Participate in joint inventories and sign for Government-Furnished Information (GFI)

4. Continue to develop and submit required deliverables

5. Attend post-award meetings as required

Deliverable(s) The contractor shall create the following document:

• Phase-In Plan

Subtask 1.2.2: Prepare and Update Phase-Out Plan A Phase-Out Plan shall be submitted 90 calendar days prior to the completion of the base period and shall be updated at the request of the COR. The purpose of the Phase-Out Plan is to ensure that the MSIX Contractor is prepared at all times during the life of the contract to facilitate a smooth and orderly transfer of contract responsibility to a successor Contractor, to the Government, or to retire the system.

Also, the Phase-Out Plan shall allow for management personnel of the incoming workforce to observe operations and performance methods of the incumbent Contractor. The Contractor shall not defer any requirements for the purpose of avoiding responsibility or of transferring such responsibility to the succeeding Contractor. The Contractor shall fully cooperate with the succeeding Contractor and the Government so as not to interfere with their work or duties. The COR will review the submitted Phase- Out Plan and make requested changes as needed. The MSIX Contractor shall update the Phase-Out Plan in accordance with the COR’s requested changes.

Deliverable(s) The contractor shall create and update, as required, the following document:

• Phase-Out Plan

Subtask 1.2.3: Execute Phase-Out Plan (Optional Task) If Optional Task 1.2.3 is exercised by the Government, the MSIX Contractor shall execute the phase-out.

The COR will notify the MSIX Contractor whether the MSIX operations are being transferred to a successor Contractor, whether the MSIX operations are being transferred to the Government, or whether the MSIX system is being retired.

• If MSIX operations are being transferred to a successor Contractor or the Government, during this time, management personnel of the incoming workforce or Government may observe operations and performance methods of the incumbent MSIX Contractor. This Phase-Out Plan will allow for the orderly turnover of equipment and records and will ensure continuity of service. The MSIX Contractor shall not defer any requirements for the purpose of avoiding responsibility or of transferring such responsibility to the succeeding Contractor or Government.

The MSIX Contractor shall fully cooperate with the successor Contractor and the Government to accomplish this task.

• If the MSIX system is being retired, all digital information to include contract and system documentation, web pages, and databases and data shall be packaged and delivered to the COR during this time. All software licenses directly paid for by the contract shall be transferred to the Government, and the MSIX Contractor shall properly package and deliver all equipment to the Government (or dispose of it), in accordance with Federal guidelines.

• Execute Phase-Out Plan

Task 1.3: Project Management Support The MSIX Contractor’s project management shall include detailed planning and coordination of contract activities and related technical engineering activities to enable the efficient operations, sustainment, documentation, enhancement, and maintenance of MSIX. The Contractor shall provide project management support to promote the optimal use of Contractor resources, ensure adequate contract performance, and establish management controls to deliver quality services within budget and on time.

The Contractor may also be required to provide assistance to the Department in developing strategies to address non-technical concerns for operating a system that is used nationwide.

Project management shall consist of:

1. Management of the MSIX Contractor’s activities using industry standard project management processes to initiate, plan, execute, control, and close the project in agreement with the Guide to the Project Management Body of Knowledge (PMBOK) or other industry standards.

2. Monthly progress reports that include, at a minimum: a brief, factual summary description of operation and maintenance activity and costs incurred for each task (or groups of tasks) during the reporting period, work scheduled for the next reporting period, variances between work scheduled and work performed, issues, risks and proposed corrective actions.

3. Monthly performance reports including performance measurement status as required by this contract and an extract from the risk management repository.

4. Attend Information System Security Officer (ISSO), Quarterly Plan of Action and Milestones (POA&M), and other security meetings.

5. Participate in weekly status meetings, alternating inperson and webinar status meetings, , to track the status of MSIX contract deliverables. During these meetings, the MSIX Contractor must provide a weekly status report and briefing on MSIX contract activities.

6. The MSIX Contractor shall develop a Project Management Plan of processes and procedures that demonstrate management controls are in place, used, and quality controls are conducted. The MSIX Contractor shall deliver the Project Management Plan to the COR for review and approval no later than 15 calendar days after contract award date.

7. Management of daily MSIX operation.

8. Participation and interface with Independent Verification and Validation (IV&V) staff (could be either Government or contracted). The Department plans to retain the services of IV&V support to provide oversight, monitoring, and other IV&V activities. The Contractor shall provide full cooperation with IV&V Contractor and IV&V activities, including making Contractor staff, documentation, and computer code available, upon mutually agreeable dates, for purposes of this activity.

9. Participation and interface with staff that provide information required by the OMB to evaluate MSIX as a major investment in the Office of Elementary and Secondary Education (OESE). At the minimum the Contractor is required to assist in collecting and submitting performance metrics and other data required for OMB monthly and quarterly updates, the annual Program Assessment, the annual Operational Analysis Report and the Corrective Action Plan for the Program Assessment.

10. The MSIX Contractor shall develop and maintain an Integrated Project Schedule using Microsoft Project. The Contractor shall deliver the Integrated Project Schedule to the COR for review and approval no later than 20 calendar days after contract award date.

11. The Contractor shall establish baselines and set targets for performance metrics and performance measures utilizing the sample chart of performance metrics provided below. The Contractor shall deliver the Baselines and Targets to the COR for review and approval no later than 30 calendar days after contract award date.

Desired Outcomes

(What are the goals as a result of this contract?)

Required Services

(What task must be accomplished to achieve the desired result?)

Performance Standard

(What should the standards for completeness, reliability, and quality be?)

Acceptable Quality Level

(AQL)

(How much error is acceptable?)

(Monitoring Method)

(How is success defined?)

12. The MSIX Contractor shall establish an electronic project library or create one using the existing

MSIX Program SharePoint Site in the Department’s intranet. As part of this library, the Contractor shall update and create (where necessary) MSIX documents, plans, and deliverables.

13. The MSIX Contractor shall, upon request from the Department, provide advice, recommendations, and strategies to address migrant education concerns.

For major system upgrades or enhancements that include equipment and or software changes, the MSIX Contractor shall develop and maintain an Integrated Project Schedule. The Project Schedule shall consist of a Microsoft Project file that includes proposed tasks, timelines, and start and finish dates for tasks that apply (i.e. equipment refresh, scheduled software upgrades, enhancements and innovations).

Deliverable(s):

The Contractor shall update (as required) the following documents:

• Change Management Plan (Annual)

• Configuration Management Plan (Annual)

• Data Management Plan (Annual)

• Personnel and Staffing Plan (Monthly)

• Personnel Roster (Quarterly or as needed)

• Process Improvement Plan (Annual)

• Project Management Plan (Annual)

• Quality Control Plan (Annual)

• Quality Management Plan (Annual)

• Requirements Management Plan (Annual)

• Requirements Traceability Matrix (As needed)

• Risk Management Plan (Annual)

• Scope Management Plan (Annual)

• System Concept of Operations

• System Development Plan(As needed)

• System Design Document (As needed)

The Contractor shall create and update (as required) the following documents:

• Integrated Project Schedule (Annual)

• Monthly Status Report (Monthly)

• Weekly Status Report (Weekly)

• Weekly Status Briefing (Weekly)

• Work Breakdown Structure (WBS)(Monthly)

• Contractor’s Electronic Project Library or library in the MSIX Program SharePoint Site (As needed)

Task 2: MSIX Operation The MSIX Contractor shall keep the current MSIX fully operational with all existing functionality in accordance with the System Design Document including but not limited to the following tasks:

Task 2.1: MSIX Administration The task includes, but is not limited to:

• The Contractor’s information systems shall be developed in accordance with the Department’s Lifecycle Management Framework (LCM), ACS-OCIO 1-106.

• Back-up, restore, and archive files and databases on all MSIX servers;

• For planning purposes, the following information relating to the current database applies and is subject to only marginal fluctuation:

o Number of databases 26

8 environments x 3 types of databases + 2 RMAN-BACKUP Repos databases o Number of tables

Database MSIX Tables All Tables Grand Total 1876 31091 o GB of allocated space MSIX PROD servers: 3430 GB o Technologies 26 Oracle Database (EE) 11gR2 ver 11.2.0.4 10 Oracle Web Tier (OracleWeb Cache, Oracle HTTP Server) ver 11.1.1.9.0 10 Oracle WebLogic Server 12c ver 12.1.1.0 8 Oracle WebLogic Server 11g ver 10.3.6.0 8 Oracle Internet Directory ver 11.1.1.7

• Maintain and optimize standard configurations on all infrastructure components;

• Perform installation and configuration of new infrastructure MSIX network and system components;

• Upgrade existing hardware and software components of the infrastructure.

• Manage storage space on all servers;

• Establish and maintain accounts and passwords for all Federal employees, Contractors, and end-users that access the MSIX. The Contractor shall use two-factor authentication per the approved Homeland Security Presidential Directive 12 (HSPD-12.) to perform system administration activities;

• System administration activities: set thresholds and monitor system for load balancing and system failover issues; ensure system infrastructure scalability for growing user base; implement and monitor failover strategies; monitor best practices for continued system tuning;

• Database administration activities : Monitor performance and storage needs as data and user base sizes increase; implement failover and load balancing strategies; fine tune database code for top performance and best practices;

• State submission of data must be accomplished via secured File Transfer Protocol (SFTP and

FTPS).

• Annual growth in the total number of students added will be minimal, population is approximately 325,000 students. It is expected that the number of records in the database, currently at 250 gigabytes (gb) of disk space, will increase by 25% a year;

• Manage new releases and implementation as they become available. Prepare release notes and updated Test Analysis Reports within 10 business days prior to any new release of MSIX software;

• Nightly data ingestion for frequency and volume of files loaded (average files received per day:21; Average student records received per day: 7,583; and average number of MDEs received per day 148,088); and (

• Ensure scalability of records to support increases in student and user record volume.

Deliverable(s) The Contractor shall create and update (as required) the following documents:

• MSIX Database Report (Monthly)

• Performance Report (Monthly)

Subtask 2.1.1: System Interconnection and Data Ingestion In order to achieve the goals of the migrant student record exchange initiative, migratory student data from each State must be loaded into MSIX through systems interconnections between State systems and MSIX. System Interconnection must follow a life-cycle management approach with an emphasis on security, including planning, establishing, maintaining, and disconnecting the interconnections.

• The interconnections must be managed, monitored and secured in compliance with FISMA, OMB Circulars A-130, and current revision of NIST SP 800-47: Security Guide for Interconnecting Information Technology Systems, NIST SP 800-53 Revision 4: Security and Privacy Controls for Federal Information Systems and Organizations, and FIPS 200: Minimum Security Requirements for Federal Information and Information.

• State data interfaces will require the completion of Memorandum of Understandings (MOUs) and Interconnection Security Agreements (ISAs). The MOUs define the roles and responsibilities of the participating organizations. The ISAs specify the technical and security requirements of the interconnections. The Contractor is responsible for reviewing the MOU and ISA for each State and system every year and for working with OME in the renewal process every three years or as needed in accordance to the applicable Federal information security policies.

• After the completion of MOUs and ISAs, the interfaces must first be tested to verify that each state can send and receive data effectively to MSIX in the correct format and according to the prescribed procedures. The State Data Ingestion tasks encompass the process to test the state interfaces and load each state’s migrant student data into MSIX. The data is categorized in three phases:

1. Phase I (demographic and enrollment data)

2. Phase II (Assessment)

3. Phase III (Course History)

• The Contractor will work with States that are new, have changed systems, or are not submitting the required Phases to develop a States’ Assistance Implementation Plan within 90 calendar days after contract award. The Plan will include the courses of action, costs, and schedule for each State and its vendor to modify their existing MSIX interface to provide the required phases of data (Demographic and Enrollment, Assessment, Course History). These data are maintained at the local school district level in many states, thus further analysis may be required by state teams and vendors to determine how current interfaces will need to be modified.

• The MSIX Contractor will continue to support the States ingestion process as it currently functions. Each state’s interface transmits demographic, enrollment, assessment and course history data. Ingesting the remaining states data is a high priority for the contract. This involves developmental, testing, and help desk function support.

• As states are brought into the MSIX, the Contractor will test (or retest in the event of changes to a state’s current interface) and certify each state’s interface to validate that it is correctly transmitting all data elements.

• The Contractor will be required to provide new testing and deployment of existing MSIX Web Services capability. These efforts include testing and facilitation of web services for new states that desire this functionality in accordance with the existing Web Services Onboarding document.

• State Data Ingestion Agreements and Data Ingestion Reports - of all states certifying or recertifying data submission interfaces, as well as the submission status of certified interfaces.

The Contractor shall update (as required) the following documents:

• States’ Assistance Implementation Plan (Annual)

• State Data Ingestion Agreements

• Data Ingestion Reports (Monthly)

• Interface Control Document (Annual)

• Interface Control Specification (Annual)

• MOU and ISA review (Annual)

• MOU and ISA renewal (Every three years)

• Inbound Flat File Specifications (As needed)

• Outbound Response Flat File Specifications (As needed)

• Web Services On-boarding (Annual)

Subtask 2.1.2: Web Site Administration The MSIX website is subject to the same conditions expressed on Task 2.1 MSIX Administration. The MSIX Contractor must be able to make content changes as required by the COR upon approval of the Change Control Board (CCB) (e.g., change, add, or remove information and documents). The CCB is made up of the Contractor, the IV&V team and the COR. Also, the MSIX website and any modification to existing website must comply with the following:

• The Contractor shall ensure that the site complies with OMB Memorandum M-03-22 http://www.usa.gov/webcontent/regs_bestpractices/omb_policies/privacy.shtml, which requires the posting of a privacy policy.

• MSIX websites must have a “.gov” hostname (typically hostname.ed.gov) is required for all government funded websites under OMB Memorandum M-05-04 (http://www.usa.gov/webcontent/regs_bestpractices/omb_policies/domains.shtml).

• The Contractor shall ensure that any “ED-Sponsored” content is identified prominently with Department of Education, and the ED.gov logo should be displayed prominently and made a link to the ED.gov homepage. The compliance policy is described in the http://www2.ed.gov/internal/wwwstds.html#sponsor.

• The Contractor shall ensure that any non-Federal sponsored websites or content (outside of .gov, .mil, .Fed.us, etc.) that is linked to complies with “ED.gov” Management and Publishing Policies” at http://www2.ed.gov/internal/wwwstds.html#link and the OMB Memorandum http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-04.pdf .

• Compliance with information found at “http://www2.ed.gov/internal/extsite-tips.html” must be maintained.

• All web and software developed under this work statement will comply with the Section 508 of the “Americans with Disabilities Act” technical standards for web and software accessibility located at 36 CFR 1194.21 and 1194.22. MSIX previously received certification in 2007.

Subtask 2.1.3: Fault Problem Detection, Documentation, and Resolution Tasks include,:

• Monitor the MSIX infrastructure for faults and problems;

• Investigate to determine the nature of the fault or problem;

• Initiate action to resolve fault or problem and restore the infrastructure to proper operational status and health;

• Escalate resolution of the fault or problem according to defined escalation procedures;

• Document the fault or problem for the Daily Incident Report and Monthly Incident Status

Report;

o Daily Incident Report - A listing of all “incidents” during the prior 24 hour period shall be produced and if appropriate, provided for review with Government staff. An “incident” is any outage, problem, tasking, or alert of sufficient importance to the integrity of MSIX and its normal operations to merit tracking of the status of the incident to closure. The Daily Incident Report shall be available for review no later than 9:00 AM local time, Monday through Friday. The Monday report shall list the incidents that occurred Friday morning through the start of business Monday morning.

http://www.usa.gov/webcontent/regs_bestpractices/omb_policies/privacy.shtml o Monthly Incident Status Report - This status report shall summarize all of the incidents reported and tracked during the month, and analyze in more detail the incidents identified by the Government staff as important. The Monthly Incident Status Report shall serve as a formal record of the description and diagnosis of each incident, the actions taken on each incident, and its final disposition. This report is due by the 10th business day of the following month.

• Network and systems monitoring including, but not limited to:

o Scan error and audit logs for designated infrastructure components;

o Monitor network and system management software for problems, outages, alerts and anomalies affecting the infrastructure, during normal and extended working hours;

o Monitor the performance and capacity utilization of designated infrastructure components;

o Monitor status of fault/problem resolution activities to ensure continuity and to escalate problems as required; and o Conduct a root cause analysis as required for faults/problems as they occur.

• Daily Incident Report (As needed)

• Monthly Incident Status Report (Monthly)

Subtask 2.1.4: Testing The Contractor shall provide for the development and implementation of test plans, procedures, and documentation for updated releases, equipment replacement and other changes to components of MSIX. Validation of releases shall include thorough, documented, and successful testing of the system prior to release. The release shall follow a pre-planned process and shall include the complete agreed-upon scope, be on time, and within budget. Testing activities including unit, system integration, as well as regression testing, and user acceptance shall be scheduled in advance. Products to be placed under configuration management will be tested by a corresponding testing activity. The Department will conduct independent verification and validation on any changes to the MSIX. Test products (test cases, data, tool, configuration, and criteria), shall be released through configuration management and be documented as part of the Systems Development Life Cycle (SDLC). Tests shall be described in traceable procedures and have pass-fail criteria included. Schedule delivery of testing documentation and outcomes in advance and distribute these documents to the COR and their designees.

Deliverable(s) The Contractor shall create and update (as required) the following documents:

• System and Acceptance Test Plan (Annually)

• Development Test Results (As needed)

• Development Test Scripts (As needed)

• Shakedown Test Results (As needed)

• Test Analysis Report (As needed)

Subtask 2.1.5: Internet Protocol version 6 (IPv6) The Contract shall provide commercial off-the-shelf (COTS) solutions that are IPv6 capable. An IPv6 capable system or product shall be capable of receiving, processing, transmitting and forwarding IPv6 packets or interfacing with other systems and protocols in a similar manner to that of IPv4. Specific criteria to be deemed IPv6 capable are:

• An IPv6 Capable system must meet the IPv6 base requirements defined by the USGv6 Profile and testing program as found here “http://w3.antd.nist.gov/usgv6/testing.html”.

• Systems being developed, procured or acquired shall maintain interoperability with IPv4 systems/capabilities. Systems shall implement IPv4/IPv6dual-stack and shall also be built to determine which protocol layer to use depending on the destination host it is attempting to communicate with or establish a socket with.

• If either protocol is possible, systems shall employ IPv6. The Contractor shall provide IPv6 technical support for system development, implementation, and management.

Subtask 2.1.6: Equipment The Contractor will be working on operating and maintaining a technical infrastructure in support of MSIX activities. This technical infrastructure is composed of items as shown in the Appendix and encompasses the following:

During the beginning of the base period Transition-in, MSIX operation will continue with the current infrastructure at Hewlett-Packard (HP).

Transition Control Protocol/Internet Protocol (TCP/IP) based

• Microsoft Exchange Email

• Microsoft Systems Management Server (SMS)

• Local Area Network (LAN) components and devices

• Cable plant

• Network protocols, network operating system (OS), and network management software

• LAN File transfer protocol (FTP) server components and devices

• Distributed application server components and devices, OS interfaces, system management software, and resident applications [commercial off-the-shelf (COTS) and custom applications]

• Data center components and devices, OS interfaces, system management software, and resident applications (COTS and custom applications)

• Remedy Software

• Office Automation software – Microsoft (MS) Word, MS Excel, and MS PowerPoint, MS Access

• Asset Management

• SharePoint Portal and Windows SharePoint Services

• MS FrontPage

• Section 508 adaptive hardware and software

• System security

Subtask 2.1.6: Asset Management The Contractor shall provide a full range of Asset Management Support including, but not limited to:

• Receipt of any software licenses or certificates from the Department that may need to be obtained; Shipment of Automated Data Processing (ADP) assets, including coordination with shipping and receiving departments to ship and track inventory assets;

• If necessary, the transition of any licenses or certificates to the Government or designated individual which may include another Contractor;

• Providing a report listing updates to existing assets every 6 months; and

• Hardware inventory document must include: Identifier, Physical or Virtual, Hardware, Classification, Environment (Prod/Test/Dev), Serial/License Number, Asset Tag, Description (include point of contact for maintenance actions), End of support date, End of life date, Operating System, Version, Manufacturer Name, Model, Memory, CPU Speed, CPU Quantity, Drive Space, Physical Location

• Software inventory document must include: Name, Software Function, Software Classification, Environment, Serial/License Number, Asset Tag, Description, End of support date, End of life date, Version, Manufacturer Name

• Perform installation and troubleshooting of hardware and software as needed;

• Decommission and dispose of aging equipment ensuring that all information has been wiped/erased in accordance with applicable security regulations;

• Work with manufacturers in connection with upgrades and repairs of equipment, memory, processor upgrades, Operating Systems (OS) issues, all hardware replacements and registration of those assets;

The Contractor is responsible for ensuring adequate staffing for scheduling, performance, and reporting of these assigned tasks. The Contractor shall provide oversight of all tasks at MSIX equipment locations.

A current list of equipment is included in the Appendix to this PWS.

Deliverable(s) The Contractor shall update (as required) the following document:

• Asset Management Report (Annual)

Subtask 2.1.7: Disaster Recovery Currently, MSIX production, development, and testing servers are hosted by Hewlett Packard in Orlando, Florida. The disaster recovery site is located at the Alpharetta Data Center in Alpharetta, Georgia. During the first 90 calendar days after contract award, the Contractor must implement a disaster/training hosting solution separate from the location of the production facility that best addresses MSIX needs regarding cost, efficiency, and innovation, taking into consideration all relevant costs including equipment, labor, and facilities. The Contractor may continue operation at the Alpharetta Data Center facility or choose another location. At the end of 90 calendar days, full functionality should be in place.

The Contractor shall provide additional operations and maintenance activities to support the dedicated training environment and disaster recovery. The Contractor shall provide the labor and materials necessary to maintain full certification and continued accreditation of the separate facility and the full replication of the production site – including the loading of live data-- at this separate facility.

Deliverable(s) The Contractor shall develop and update (as required) the following documents:

• Contingency Plan (Annual)

• Disaster Recovery Plan (Annual)

Subtask 2.1.8 – Ad-hoc/Emergency Support As directed by the Government, the Contractor will provide Ad-Hoc/Emergency Support for up to 3 times per year to cover correction of unforeseen issues, i.e., database downtime, etc. that may arise as a result of deficiencies in either software or hardware. The subtask shall be priced at 40 hours of support using the Senior IT Specialist labor category.

Task 2.2: IT Systems Security The Contractor and all subcontractors shall comply with the Department’s IT security policy requirements, specifically those outlined in the ‘Handbook for Information Assurance Security Policy (OCIO-01)’, and other applicable procedures and guidance. The Contractor, and all subcontractors, shall develop and implement management, operational and technical security controls to assure required levels of protection for information systems. The Contractor, and all subcontractors, shall further comply with all applicable Federal IT security requirements including, but not limited to, the Federal Information Security Management Act (FISMA) of 2002, OMB Circular A-130 Appendix III, Homeland Security Presidential Directives (HSPD), and the National NIST standards and guidance. The Contractor, and all subcontractors, shall be in accord with OMB Memorandums M-05-04, and M-15-13, and M-08- 23, and with the NIST SP 800-44. In addition, all publicly accessible Federal websites and web services must be HTTPS enabled, and shall only provide service over a secure connection, and e-mail applications must have SMTP enabled. The Contractor, and all subcontractors, shall also be in accord with Information Assurance Security Policy (OCIO-01), Information Technology Security Certification and Accreditation Procedures (OCIO-05), General Support System and Major Application Inventory Procedures (OCIO-09), Information Technology Security Configuration Management Planning Procedures (OCIO-11), Information Security Incident Response and Reporting Procedures (OCIO-14), and Protection of Sensitive But Unclassified Information (OCIO-15).

These security requirements include, but are not limited to, the successful Certification and Accreditation (C&A) or Security Authorization (SA) of the system (includes commercially owned and operated systems managed by the commercial vendor and its subcontractors, supporting Department programs, contracts, and projects); obtaining a full Authority to Operate (ATO) before being granted operational status; performance of annual self-assessments of security controls; annual Contingency Plan testing; performance of periodic vulnerability scans; updating all information system security documentation as changes occur; and other continuous monitoring activities, which may include, mapping, penetration and other intrusive scanning. Full and unfettered access for the Department’s third party Managed Security Services Provider (MSSP) must be granted to access all computers and networks used for this system. Additionally, when there is a significant change to the system’s security posture, the system (Federal and commercial - prime and subcontractors included) must have a new C&A or SA, with all required activities to obtain a new ATO, signed by the Authorizing Official (AO). The most recent C&A occurred on July 15 of 2015.

System security controls shall be designed and implemented consistent with the current revision of NIST SP 800-53, ‘Recommended Security Controls for Federal Information Systems and Organizations.’ All NIST SP 800-53 controls must be tested / assessed no less than every three years, according to federal and Department policy. The risk impact level of the system will be determined via the completion of the Department's inventory form and shall meet the accurate depiction of security categorization as outlined in FIPS 199, ‘Standards for Security Categorization of Federal Information and Information Systems.’

System security documentation currently in place shall be updated to record and support the implementation of the security controls for the system. This documentation shall be maintained for the life of the system. The Contractor, and all subcontractors, shall review and update the system security documentation at least annually and after significant changes to the system, to ensure the relevance and accurate depiction of the implemented system controls and to reflect changes to the system and its environment of operation. Security documentation must be developed in accordance with the NIST 800 series and the Department’s policy and guidance.

The Contractor, and all subcontractors, shall allow Department employees (or Department designated third party Contractors) access to the hosting facility to conduct C&A/SA activities to include control reviews in accordance with the current revision of NIST SP 800-53 and NIST SP 800-53A. The Contractor, and all subcontractors, shall be available for interviews and demonstrations of security control compliance to support the C&A/SA process and continuous monitoring of system security. In addition, if the system is rated as ‘Moderate’ or ‘High’ for FIPS 199 risk impact, vulnerability scanning, and penetration testing shall be performed on the hosting facility and application as part of the C&A/SA process. Appropriate access agreements will be reviewed and signed before any scanning or testing occurs.

Identified deficiencies between required current revision of NIST SP 800-53 controls and the Contractor’s and all subcontractors’ implementation, as documented in the Risk Assessment Report, System Security Plan (SSP) and Security Assessment Report (SAR), shall be tracked for mitigation through the development of a Plan of Action and Milestones (POA&M) in accordance with the ‘Handbook for Information Assurance Security Policy.’ Depending on the severity of the deficiencies, the Department may require remediation before an ATO is issued.

All awarded IT contracts shall ensure that:

1. Their IT product/system is monitored during all hours of operations using entrusted detective/preventive systems;

2. Their IT product/system has current antiviral products installed and operational;

3. Their IT product/system is scanned on a reoccurring basis;

4. Vulnerabilities are remediated in a timely manner on their IT product/system; and

5. Access/view for cyber security situational awareness on their IT product/system is made available to the Department CIRC (cyber incident response capability).

If there is a suspected or known breach/disclosure of PII due to lost, theft, intercepted transfer, or other, the Contractor must ensure that this breach…