HE125421R3000 0002 Modification Copy.docx.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to:

1. Post the second round of questions and answ ers for offerors.

2. Update the Product Service Code from D318 to DA10.

3. Update the PWS at sections 2.1.6 and 4.2.

4. Changed verbiage in Attachment 7 from "Vendor Questions and Government Responses – Questions 1 through 17" to "Offeror Questions and Government Responses – Questions 1 through 17".

See Summary of Changes.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 28

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 05-Nov-2020

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HE125421R3000

X 9B. DATED (SEE ITEM 11)

20-Oct-2020

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

05-Nov-2020

CODE

DOD EDUCATION ACTIVITY

ATTN: PROCUREMENT DIVISION

4800 MARK CENTER DRIVE

SUITE 05F09-02

ALEXANDRIA VA 22350-1400

HE1254 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

HE125421R3000

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

SUPPLIES OR SERVICES AND PRICES

CLIN 0003

The PSC code has changed from D318 to DA10.

CLIN 0004

CLIN 0005

CLIN 0006

CLIN 0007

CLIN 0008

CLIN 1003

CLIN 1004

CLIN 1005

CLIN 1006

CLIN 1007

CLIN 2003

CLIN 2004

CLIN 2005

CLIN 2006

CLIN 2007

CLIN 3003

CLIN 3004

CLIN 3005

CLIN 3006

CLIN 3007

CLIN 4003

CLIN 4004

CLIN 4005

CLIN 4006

CLIN 4007

CLIN 5003

CLIN 5004

CLIN 5005

CLIN 5006

CLIN 5007

CLIN 6001

The following have been added by full text:

ATTACHMENT 8

Learning Management System for DoDEA World-Wide

Solicitation Number: HE125421R3000

Offeror Questions and Government Responses – Questions 18 through 40

Q18. Will the government accept custom solutions with an integrated COTS LMS to address the requirements vs. 100% COTS only? Given the specificity of requirements, a single 100% COTS only product is unlikely to address all requirements out of the box. Further, ability to customize on top of the

LMS will lend itself to leveraging other modalities of learning, and not be limited to LMS functionality out of the box.

A.18: Per the PWS section 2.1.1.6 para 4-

“ Interface customization and branding, e.g., customize url, branding on the front page, logo, colors, fonts, images, login and subsequent web pages. Note: The Government specifically requires a COTS product with common features/components so that customization is minimal or unnecessary”.

Per the PWS section 2.1.5 -Task 5, Customization (Remote)

“The Contractor shall perform remote customization tasks, as r equired. Note: Although DoDEA requires a COTS solution, past experience has shown that minor customization requirements arise post-award”.

Q19: For those requirements that are not available in the COTS LMS out of the box immediately, Is it acceptable to configure/customize the deltas (requirements) on top of the COTS LMS, so they can be made available, between the start of the performance and some future date or milestone the government specifies?

A19: All offerors shall follow the proposed LMS Migration Plan found in the PWS at Technical

Exhibit #1.

Q20: Could you please advise if there is an incumbent, the incumbent name, contract number, period of performance and the award amount over the full period of performance?

A20: The Government will not disclose any past contract information. The offeror may research past contract awards via public domain.

Q21: Would the government please confirm the level of effort for this work is the same as the current contract?

A21: No we cannot confirm level of effort.. This is a firm fixed price contract and the level of effort is dependent upon the proposed offerors LMS solution.

Q22 Can the government advise types and number of resources currently in place in the existing contract to support the requirements (LCATs and ODCs)?

A22: No

Q23: Could the government extend the submission date to allow adequate time for the Q&A and any follow on clarifications?

A23: The submission deadline remains as stated – no extensions will be granted.

Q24: Could the government provide historical number of user assistance inquiries and requests received into the helpdesk?

A24: Historically we had less than 50 tickets per year.

Q25: Can the government clarify what requires migration into the new LMS? i.e. existing SCORM courses, learner data currently maintained by existing LMS? Anything else?

A25: See the PWS section 2.1.3 -Task 3, System Migration as well as Technical Exhibit #1

Q26: Who is primarily responsible for developing online SCORM courseware?

A26: DoDEA is responsible for creating the course content; however the offeror must be capable of

SCORM compliance. See 2.1.1.3 and 2.1.1.4, DoDEA expects to create course content within the LMS, and the vendor must “Ensure, where applicable, that all online content for publishing and reusability is SCORM®-compliant.” See 4.4.

Q27: Is the contractor expected to develop SCORM courseware?

A27: DoDEA is creating the courses. The LMS must provide SCORM compliancy. See 2.1.1.3 and

2.1.1.4, DoDEA expects to create course content within the LMS, and the vendor must “Ensure, where applicable, that all online content for publishing and reusability is SCORM®-compliant.” See 4.4.

Q28: Will the government accept capability for developing learning content (SCORM modules, surveys, polling, etc.) outside of the LMS, which can later be deployed and imported in the LMS, or must the content development functionality be natively part of the LMS?

A28: The LMS must provide native capability for the features specified in DoDEA’s LMS requirement.

See 2.1.1.3: The following course-level functions and features are required, 1) Inline content creation, and 3) surveys and polling, AND See 2.1.1.4 include the following content-and assessment-level functions and features 2) Contextually relevant content import, creation, and configuration.

Q29: Can you confirm the requirement to host both synchronous and asynchronous learning resources on the LMS---i.e. virtual, instructor-led classes, chats, blogs, discussions AND online courseware pursued independently of an instructor?

A29: Internal social collaboration tools-blog, wiki and disscussion boards are required. Live chat and web conferencing is a plus. All courses will be available independently without an instructor.

See 2.1.1.2, item 6: Possess the following system-level functions and features, “Internal social collaboration tools such as live chat, blog, wiki, discussions, and web conferencing”

Q30: If asynchronous online courses are to be hosted: a) Who has developed/will develop the courses?

B) How large are the courses (duration, SCORM package size)?

A30: Asynchronous online courses are to be hosted. DoDEA will provide the courses. Durationa and

SCORM package size will vary depending on images, video etc.

See 1.3, Scope of Work, “DoDEA requires an LMS with (1) an intuitive interface for the creation, delivery and tracking of web-based curricular content and instructional/assessment activities and (2) collaboration tools to both replicate and extend modalities found in a traditional PK-12 classroom environment.” and See 2.1.3.1.2, “The number of courses to be migrated from the current LMS are approximately 500.”

Q31: Can you be specific about the requirements for ‘inline content creation’ and ‘instructor-generated content’? What types of learning resources hosted on the LMS would require the capability for an instructor to have input?

A31: The LMS must be capable of creating inline content such as lessons, quizzes, assignments, content. See 1.3, Scope of Work, DoDEA requires an LMS with (1) an intuitive interface for the creation, delivery and tracking of web-based curricular content and instructional/assessment activities…”

Q32: Is there a requirement for user-specific learning paths (i.e. custom paths through learning resources based on learner outcomes)?

A32: No.

Q33: What authoring tool(s) are the current courses developed in (the 500 or so that that need to be migrated)?

A33: There are a variety of tools - see 2.1.1.4 “…content- and assessment-level functions and features.”

Q34: What is the average size of a single course or approximate size of the 500 courses to be migrated?

A34: Courses are of typical size for a K-12 course containing 1-2 semesters of lessons/assessments.

Q35: Can you provide detail re: what “Customizations (Remote)” will be required?

A35: Although DoDEA requires a COTS solution, past experience has shown that minor customization requirements arise post-award. Minor customization such as LTI, API, SIS integration.

Q36: Can you provide sample scope of the customizations the contractor will be required to support each year to size the effort adequately?

A36: See answer to question 35.

Q37 What cybersecurity system classification (confidentiality, integrity, availability or CIA level) is required for the new LMS solution?

A37: The CIA level should be Moderate for the new LMS solution.

Q38: The technical support helpdesk requirement is 24/7/365, however under section 4.2 constraints federal holidays are recognized. Can the government clarify if service is expected from the technical support helpdesk during these holidays?

A38: Provide synchronous responses to all issues within one business day, except for Federal holidays and Federal government closures/shutdowns.

Q39: Is technical support required 24 hours a day, i.e. and not limited to business hours?

A39: Provide global technical support via phone, email, helpdesk service portal, or combination of the three 24/7/365, for LMS errors, regular system maintenance, upgrades, and troubleshooting. Technical support services shall operate under Service Level Agreements (SLA) and include provisions for issue prioritization and appropriate issue escalation procedures.

Provide synchronous responses to all issues within one business day.

Q40: What contact modalities must the technical support team support – email, phone, any others?

A40: Per the PWS section 2.1.6- Task 6, Technical Support and Maintenance: “Provide ongoing

24/7/365 global technical support via phone, email, helpdesk service portal, or combination of the three, for LMS errors, regular system maintenance, upgrades, and troubleshooting”.

The following have been modified:

ATTACHMENT 1

DoDEA PK-12 Learning Management System (LMS)

Performance Work Statement

1 GENERAL INFORMATION

1.1 Agency:

For school year (SY) 2020-21, the Department of Defense Education Activity (DoDEA) will provide PK-12 instruction to approximately 68,500 dependents of military and civilian employees. Student enrollment is based primarily on deployment of military troops worldwide. In the Americas, DoDEA operates 50 schools located in seven states, Puerto

Rico, and Cuba. In Europe and the Middle East, DoDEA operates 64 schools located in

Germany, England, Netherlands, Belgium, Spain, Turkey, Bahrain and Italy. In the

Pacific, DoDEA operates 45 schools located in Korea, Japan (mainland and Okinawa), and

Guam. DoDEA's curriculum, resources and student achievement scores on standardized assessments compare favorably to those of high-performing US public school systems. In addition, DoDEA operates fully accredited Virtual High School with teaching hubs in each

DoDEA region: Americas, Europe, and Pacific.

1.2 Background

DoDEA has identified five goals: Student Excellence, School Excellence, Talent Excellence, Organizational Excellence, and Outreach Excellence in support of our Blueprint for Continuous

Improvement (https://www.dodea.edu/Blueprint/). To support primarily Goal 1, Student

Excellence, DoDEA requires a learning management system (LMS) related to instructional content development and delivery, alignment to our College and Career Ready

Standards (CRRS), and facilitating social interactions within the PK-12 classroom, virtual school environment and professional learning opportunities for educators. DoDEA has amassed a large volume of K-12 courses and resource-related sites, which are currently hosted on its LMS platform, Schoology.

Table 1: Student Enrollment – SY 2020-21 (rounded to nearest 50 students)

Grade Students Grade Students Grade Students Grades Students

PK 3,750 3 6,350 7 4,950 11 3,000

K 6,750 4 5,800 8 4,350 12 2,750

1 6,700 5 5,600 9 3,650 K-12

Total

68,500

2 6,400 6 5,250 10 3,250

1.3 Scope of Work

DoDEA requires a secure contractor-hosted, scalable, cloud solution that can accommodate approximately 64,750 K-12 students and 12,500 employees. DoDEA requires an LMS with

(1) an intuitive interface for the creation, delivery and tracking of web-based curricular content and instructional/assessment activities and (2) collaboration tools to both replicate and extend modalities found in a traditional PK-12 classroom environment. With consideration to the wide range of cognitive and fine motor skills of the K-12 student population, DoDEA requires an LMS interface that is (1) easy to navigate and (2) efficient and judicious in its display of visual, contextually relevant information in order to avoid confusion and impede instructional flow. DoDEA expects to award one firm-fixed price contract for a 5-year base period and five option years—a total of ten years. Note: Shown in the table above, DoDEA’s estimated student population in SY20-21 totals 68,500. DoDEA, however, only expects to purchase licenses for students in grades K-12, an estimated 64,750.

2 REQUIREMENT (OBJECTIVES)

2.1 Objective 1, Comprehensive LMS Solution

Provide a comprehensive, cloud-based, commercial off-the-shelf (COTS) LMS solution providing access to DoDEA K-12 students, as well as additional access for school-level and above-school-level educators and administrators, and parents/sponsors systemwide.

The LMS solution shall include virtual product training, maintenance, updates, and technical support.

2.1.1 Task 1, LMS Access—The Contractor’s solution shall:

2.1.1.1 Include interaction design (IxD) and user-centered design (UCD) principles for its user interface (UX) to help streamline the adoption and extended use of the system by all DoDEA constituencies. The solution shall be intuitive with clear direction for navigation and common tasks performed by teachers, K-12 students, and parents. The LMS shall (1) support social learning in a

K-12 environment and (2) include features and functions to allow users to perform specific tasks or consume relevant information at the appropriate levels within the system.

2.1.1.2 Possess the following system-level functions and features:

1) System notifications and alerts such as announcements and calendar notifications

2) Registration and enrollment

3) User authentication, single sign on, and account provisioning mechanisms

4) System integration, extensibility, and Representational State

Transfer (REST) Application Programming Interface (API) support (see 3.11.1.1 below for additional detail)

5) Course catalog

6) Internal social collaboration tools such as live chat, blog, wiki, discussions, and web conferencing

7) Reporting and tracking such as the number of users, number of courses and sections, user login/logout, account management, etc.

8) Section 508 compliance and multilingual support

9) Automated user transfer among districts, schools, and courses

10) Ensure offeror content accessible from the web is compatible with the following browser platforms: Internet Explorer 11, Google Chrome and

Edge. Ensure that any applicable STIGs are implemented.

11) Ensure, per Section 2.1.3.1.3 (below), any software installed and/or accessed in or by a DoDEA system, network whether stand-alone or web-based, is compatible with standards cited herein.

12) Provide the minimum desktop/server system technical specifications, available reference architectures, networking specifications and diagrams, and applicable systems configuration documentation for the proposed product solution.

13) Ensure all software is compatible with the following minimum baseline:

Specifications Minimum

Memory 4 GB

Hard Drive 100 GB

Processor

Intel® Core™ i5-8365U Processor 8th Generation (up to 4.1GHz, 6MB cache) equivalent or better (Must show benchmark/passmark scores)

Video Graphics Integrated Intel HD Graphics 620 (1920x1080) equivalent or better

Operating System Windows 10

Browser Environment Chrome; Edge; IE 11 or higher

14) Ensure that all software is completely functional on a standard DoDEA desktop without the need/requirement for administrative-level user rights and/or permissions or the requirement to use or insert external media to execute the software.

2.1.1.3 Include the following course-level functions and features:

1) Inline content creation

2) Course role and group management

3) Surveys and polling

4) Reporting and tracking such as date/time stamp content created/deleted/inserted/copied; grade changes such as entries/deletions

5) Course notifications and alerts such as forums, announcements, updates, messages, due date notifications, calendar notifications

6) Internal social interactions such as live chat, blog, wiki, discussions and web conferencing

7) Grade book

2.1.1.4 Include the following content- and assessment-level functions and features:

1) Standards support including question and test interoperability (QTI), learning tools interoperability (LTI), instructional management systems common cartridge (IMSCC) and shareable content object reference model

(SCORM) compliance

2) Contextually relevant content import, creation and configuration

3) Learning object management and reusability

4) Media and rich content support

5) Metadata support—more specifically, documentation covering available data attributes and the usage of available fields in the system

2.1.1.5 Possess the following user-level functions and features:

1) User profile management

2) User notifications and alerts such as announcements, updates, messages, due date notifications, calendar notifications

3) Internal social collaboration tools, such as live chat, blog, wiki, discussions and web conferencing

4) Reporting and tracking such as user level date/time last login/logout of the

LMS, course access, date/time content access, assignment/quiz/test access/submissions/attempts/duration

2.1.1.6 Include the following administrator-level functions, features and resources for at least three high-level administrative and three mid-level “super users”:

1) Administrator-level controls for system and lower level features, allowing configuration of security, form fields, and dropdown options.

2) Manual batch and automated processing of users, courses, content, and enrollments between DoDEA’s student information system (SIS, currently

Aspen).

3) Native customizable data import and export mappings with our SIS

4) Interface customization and branding, e.g., customize url, branding on the front page, logo, colors, fonts, images, login and subsequent web pages.

Note: The Government specifically requires a COTS product with common features/components so that customization is minimal or unnecessary.

5) Provide relevant documentation covering the administrative functions for overseeing and using the LMS.

2.1.1.7 Incorporate a native curriculum management repository and inline content creation functionalities to search for and align instructor-generated learning content and standards.

2.1.1.8 Support plagiarism prevention by allowing a third-party anti-plagiarism plug-in tool that can operate in DoDEA’s secure IT environment.

2.1.1.9 Support multi-platform educational resource access to perform both student and instructor activities efficiently, including native mobile and tablet applications developed for such platforms as Apple iOS, Google Android, and Amazon Kindle.

2.1.1.10 Include a secured sockets layer (SSL) certificate to ensure all data communication between the client and server systems remain secure.

2.1.1.11 To ensure the educational technology tools provide a plug-and-play ecosystem, DoDEA requires all products to be certified with the IMS Global

Consortium. This will support interoperability with the DoDEA Student

Information System (SIS) and ClassLink (OneSync and Roster Server), by meeting the following One Roster version 1.1 Specifications:

1) Multiple transfer options - transmission through spreadsheet-style

CSV templates or through system to system data exchange (REST

API).

2) Secure provisioning of Students, teachers and other authorized system users.

3) Courses and sections data (classes).

4) Optional demographic information.

5) Academic session, semester and term information.

6) School organization information.

7) Privacy and security via well recognized security protocol, OAUTH

2.0. (The earlier support for OAUTH 1.0a is continued in this version.)

8) Transmission of formative and summative score information (results).

9) Association and transmission of learning resources for course and course sections (classes)

10) Certification separately for Resources and Results

11) Sort, filter and field selection support

2.1.1.12 The following URL is provided as reference for the architecture required to support: https://www.imsglobal.org/oneroster-v11-final-best-practice-and-implementation-guide#Architecture.

2.1.2 Task 2, Virtual Professional and Administrator Learning—The Contractor shall:

2.1.2.1 Product Training: Provide a self-help feature to allow users to locate written documentation on the functional administration and use of the LMS, and resources to train and learn how to use the virtual learning environment.

This feature shall be available on a 24/7/365 basis throughout the period of performance and may use chat, online tutorials, online video tutorials, FAQs, written documentation, live and recorded webinars, etc.

2.1.2.2 System Administrators: Provide one approximately 3-hour synchronous webinars for 5-7 administrators per region in the base year and each year thereafter determined by the Contracting Officer’s Representative (COR) post-award (in consultation with the Contractor). The Contractor shall record these sessions for use by DoDEA. The synchronous webinars shall be delivered to

US, Europe, and Pacific audiences in their respective time zones—a total of

3 sessions per year.

2.1.2.3 Staff: Provide up to 12 sessions per region of approximately three hours each of synchronous webinars for education technologists, instructional designers, teachers, and other staff in the base year per year starting with the base year, as well as additional training each year thereafter. The Contractor shall record these sessions for use by DoDEA. The synchronous webinars https://www.imsglobal.org/oneroster-v11-final-best-practice-and-implementation-guide#Architecture https://www.imsglobal.org/oneroster-v11-final-best-practice-and-implementation-guide#Architecture shall be delivered to US, Europe, and Pacific audiences in their respective time zones—a total of 36 sessions per year for a total of 180 sessions over the 5 year base period. The determination will be made by the Contracting

Officer’s Representative (COR) post-award (in consultation with the

Contractor). DoDEA shall determine the topics of each year’s webinars in consultation with the Contractor.

Provide a draft evaluation questionnaire with multiple-choice and short- answer questions to evaluate the synchronous sessions.

Finalize it, based on written feedback from the COR.

Place the evaluation questionnaire on the LMS, which shall tabulate the results automatically.

2.1.2.4 Provide all professional learning in English only.

2.1.3 Task 3, System Migration—The Contractor shall provide a system migration plan that incorporates the proposed migration plan (Technical Exhibit #1, Proposed

LMS Migration Plan) and implement the final DoDEA-approved plan.

2.1.3.1 Plan: Provide a detailed draft data migration plan with instructions to include validation and regression testing for all required migrated content and courses, and the ability for DoDEA to import and export course content packages.

Note: The storage environment for the current LMS is cloud-based and

Contractor-hosted. The types of databases currently in use include Cloud solutions, Oracle, and SQL servers. Ensure the plan adequately accounts for the challenges inherent in each of the migration plan phases, per Technical

Exhibit #1, Proposed LMS Migration Plan.

2.1.3.1.1 Interoperability Capability (IOC): The Contractor will conduct industry- standard IOC with minimal Government support and will provide results according to scheduled milestones, per the final migration plan.

1) User Acceptance Testing (UAT) #1 & #2: The Contractor in collaboration with the COR and DoDEA staff will develop a UAT plan aligned to industry-standard UAT to include showing testing results to the COR for review and feedback.

2) Full Operational Capability: Based on the completion of all migration plan milestones, as confirmed in writing by the COR, full operational capability will be given to DoDEA on or about July 1, 2021.

2.1.3.1.2 In collaboration with DoDEA staff, the Contractor will ensure that all identified content from the current Contractor-hosted cloud-based

LMS are effectively migrated into the Contractor’s LMS. The number of courses to be migrated from the current LMS are approximately

500.

2.1.3.1.3 Software and Cloud Security Requirements: The contractor shall:

1) Ensure all online resources, cloud-based services and instructional software meet the Department of Defense (DoD) and DoDEA Cybersecurity requirements as defined below.

Note: Software, cloud services and associated websites will be rigorously tested to ensure no security risks are posed to DoDEA infrastructure and its users.

2) Complete the Cloud Services questionnaire at Attachment 4 that was submitted as part of the proposal submission and provide copies of and/or access to any software in the proposed solution. If applicable.

3) Ensure on-premises software support post-installation integration of the necessary Security Technical Implementation

Guides (STIG) for applicable systems and applications, including Microsoft Windows 10, Microsoft Windows Server

2016, Windows Server 2019, Microsoft Windows IIS, Apache, Oracle databases, and Microsoft SQL Server databases. Note:

They may be downloaded from https://public.cyber.mil/stigs/downloads/. The application to view all of the STIGs may be found at the following URL:

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/unclass-

STIGViewer_2-9.zip.

4) Ensure on-premises software which will be subject to static and dynamic analysis testing imposes no risk to DoDEA systems, users and/or data. DoDEA will assess software products to ensure compatibility with existing system configurations and software, testing may also include reverse engineering analysis.

The offeror shall provide a plan of actions & milestones

(POA&M) to mitigate any cybersecurity findings resulting from non-compliant and/or vulnerable components within 30 calendar days of notification from DoDEA.

5) Per DoD policy for cloud-based services, DoDEA will conduct a supplemental series of validations, which closely mirror the Federal Risk and Authorization Management Program

(FedRAMP) Internet Cloud vetting processes. As part of this process, the Contractor shall participate, as needed, in interviews and deep system architecture inspections.

6) Provide software that does not require modifications to folder permissions while executing.

7) Ensure, if applicable, that software packages support unattended installation methods used by enterprise software packaging and deployment systems. Note: DoDEA currently distributes software packages via Microsoft System Center Configuration

Manager (SCCM). Any, older 16-bit software will be https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/unclass-STIGViewer_2-9.zip https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/unclass-STIGViewer_2-9.zip automatically denied.

2.1.3.1.4 Provide a final data migration plan based on written feedback from

DoDEA, and execute/implement accordingly.

2.1.3.2 Migration: Perform the system migration, as defined in the final LMS

Migration Plan., per 2.1.3.1 (above). Note the following time-constraint windows:

Most teachers are not in the classroom or available to perform any LMS-related work during the months of June and July.

Summer school of 2021 will require use of the existing system

(Schoology) to allow for migration and system testing.

2.1.4 Task 4, Onboarding—The Contractor shall perform onboarding tasks to ensure that all K-12 students, school-level and above-school-level educators, and parents/ sponsors can access the appropriate LMS features/functions.

2.1.5 Task 5, Customization (Remote)—The Contractor shall perform remote customization tasks, as required. Note: Although DoDEA requires a COTS solution, past experience has shown that minor customization requirements arise post-award.

2.1.6 Task 6, Technical Support and Maintenance: Provide global technical support via phone, email, helpdesk service portal, or combination of the three 24/7/365, for

LMS errors, regular system maintenance, upgrades, and troubleshooting. Technical support services shall operate under Service Level Agreements (SLA) and include provisions for issue prioritization and appropriate issue escalation procedures.

Provide synchronous responses to all issues within one business day.

2.1.7 Task 7, Meetings—The Contractor shall:

2.1.7.1 Medium and Minutes: Provide the medium through which each meeting occurs, record each meeting’s minutes, and submit them to the COR within two business days of the event.

2.1.7.2 Post-Award Conference: Participate in a video- or teleconference with the

COR five business days after award in accordance with FAR Subpart 42.5.

2.1.7.3 IT Meeting: Convene a video- or teleconference with DoDEA Information

Technology staff ten business days after award for the purposes of preparing for onboarding of new services and initial configuration of administrator-level accounts. (See Technical Exhibit #1.)

2.1.7.4 Other Post-Award Meetings: Meet with the Contracting Officer (KO), COR, and/or other Agency personnel, as appropriate, to review Contractor performance, as required by DoDEA. The KO may discuss the Agency’s view of Contractor performance, and the Contractor shall apprise the Agency of any problems being experienced. The Contractor shall take appropriate action to resolve any outstanding issues raised by the Agency.

2.1.7.5 Attendance: Attend virtual meetings at no additional cost to the Government.

Note: Costs associated with attendance at face-to-face meetings, if any, shall be handled/paid for as stated in the contract.

2.8. Task 8, Liaison/Alternate Liaison—The Contractor shall:

2.8.1 Provide a liaison and an alternate to work with DoDEA’s COR and subject-matter experts. The names of this person and an alternate—who shall act for the Contractor when the program manager is absent—shall be designated in writing to the Contracting Officer. The program manager or alternate shall have full authority to act for the Contractor on all contract matters relating to the daily operation of this contract. The program manager and alternate shall have at least one year of experience in this role.

2.8.2 Provide a single point of contact to support DoDEA in performing the required data integration activities within the Contractor’s system

2.8.3 Provide replacements, if required, that meet or exceed the qualifications and experience of those provided upon award of the contract. Notify the COR in writing regarding all personnel changes ten business days in advance of the change.

3.1 Task 9,Privacy—The Contractor shall:

3.1.1 User Accounts: Require, wherever applicable, that individual accounts possess unique usernames and passwords that do not require personally identifiable information (PII) to access online content, i.e., first & last name and any other unique personal information.

3.1.2 Contractor Personnel: Ensure personnel assigned to this contract take proper precautions to protect information from disclosure. Collect and/or store all agency-owned or agency-controlled personally identifiable information in accordance with the relevant requirements of the Privacy Act, 5 U.S.C— http://www.archives.gov/about/laws/privacy-act-1974.html.

3.1.3 Ensure Contractor staff who have access to DoDEA’s student, teacher and/or staff personally identifiable information complete DoD Privacy Act/ Personally

Identifiable Information (PA and PPI/PII) training before gaining access to the data and yearly thereafter. Provide copies of the certificates of completion to the

COR which can be audited at any time by the CISO or his/her designee.

3.2 Section 508 Compliance—Ensure Contractor resources, wherever applicable, meet the following requirements:

3.2.1 IT Requirement: Ensure that all electronic hardware and software that is procured under this contract/purchase order comply with Section 508 of the Rehabilitation

Act of 1973, as amended, (29 U.S.C. 794d) and the Architectural &

Transportation Barriers Compliance Board Electronic Information Technology

(EIT) Accessibility Standards (36 CFR part 1194). Additional information may be found at the following URL: http://www.section508.gov.

3.2.2 Deliverable Requirement: Ensure the following occur:

1) Outputs/deliverables do not adversely affect accessibility features of existing EIT technologies.

2) EIT related to the requirements are accessible to people with disabilities, per 29 U.S.C

794(d).

3) Applicable functional performance, information documentation, and support requirements are properly addressed. Standards from 36 CFR Part 1194 Subpart B, C and D apply to this acquisition.

3.3 Task 10, Optical Character Resolution (OCR): The Contractor shall provide, upon request, two digital OCR copies of print materials in one or more of the following formats:

Digital Accessible Information System/National Instructional Materials

Accessibility Standard (NIMAS) with cascading style sheet

HyperText Markup Language (HTML)

Portable Document Format (PDF), (unlocked, embedded fonts, single page)

Rich Text Format (RTF)/Word document

3.4 Task 11, Data: All Technical data developed as a result of any work awarded under this contract is and shall remain the property of the Government per DFARS 252.227-7015.

3.4.1 Data Management Requirements: The contractor shall:

3.4.1.1 Provide a mechanism for batch administration and automation of routine data management tasks via flat file import, or representational state transfer (REST) based web service application programming interfaces (APIs). The mechanism shall provision and manage data objects within the Contractor’s system, including but not limited to organizational structures, student accounts, staff accounts, courses, and class rosters.

3.4.1.2 Provide all necessary documentation and assets to facilitate batch administration and automation of routine data management tasks, including but not limited to roster template files (i.e., comma separated value templates); data element/field definitions documentation; data interchange formats and schemas

(XML/JSON); and/or data dictionaries for the purpose of mapping organizational student information system (SIS) data to the

Contractor’s required input formats.

3.4.1.3 Provide a single point of contact to support DoDEA in performing the required data integration activities within the Contractor’s system.

3.4.1.4 Configure DoDEA enterprise within its system and/or databases as the appropriate organizational entity (i.e., region, district, school) upon a request in writing from the contracting officer’s representative (COR). Note: DoDEA’s organization hierarchy consists of the following: one system, three regions, eight districts, 62 communities, and 160 schools, which includes the DoDEA

Virtual High School.

3.4.1.5 Ensure the transfer of any Sensitive, Confidential data including but not limited to PII data be transferred in a secure means meeting any requirements set by DoDEA’s Chief Information Security

Officer (CISO).

3.5 Cybersecurity Supporting Elements/Requirements and Scalability: The Contractor shall:

3.5.1 Comply with the cybersecurity requirements defined in the following documentation. These requirements are:

DoD Directive (DoDD) 8500.01E, Information Assurance, which may be found at http://dodcio.defense.gov/Portals/0/Documents/DIEA/850001p.pdf

DoD Security Technical Implementation Guidance (STIG), which may be found at http://iase.disa.mil/stigs/Pages/index.aspx

DoD Risk Management Framework (DODRMF) per DoD Instruction

8510.01 at http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf

3.5.2 Provide security patches/upgrades to include third-party applications in response to public-released security vulnerabilities associated with its software solution. Provide a POA&M for any security vulnerabilities within five business days of discovery. Software upgrades/patches shall be included in the licensing cost and be performed at the least disruptive times as determined by

DoDEA in writing. Note: Any exception to this requirement must be approved in advance and in writing by DoDEA’s Chief Information Officer (CIO).

3.5.3 Ensure that any portion of its solution that involves Internet access by DoDEA students complies with the relevant requirements of the Children's Internet http://dodcio.defense.gov/Portals/0/Documents/DIEA/850001p.pdf http://iase.disa.mil/stigs/Pages/index.aspx http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf

Protection Act, Pub.L. 106-554, § 1(a)(4) [Div. B, Title XVII, § 1701], Dec. 21, 2000, 114 Stat. 2763, 2763A-335.

3.5.4 Ensure its solution is robust enough to serve the needs of a large community of learners dispersed across the world using a variety of bandwidths and scalable to meet future growth, both in terms of instruction and the number of users.

3.5.5 Ensure the solution is scalable to meet future growth requirements in terms of instruction and number of users.

3.6 Organizational Conflict of Interest (OCI): The Contractor (including any subcontractor) personnel performing work under this contract may receive, have access to, or participate in the development of, proprietary or Privacy Act information (e.g., personal information, education, etc.) may create a current or subsequent OCI as defined in FAR Subpart 9.5. Whenever the Contractor becomes aware that such access or participation may result in actual or potential OCI, the Contractor shall (1) immediately notify the Contracting Officer (KO) in writing and (2) promptly submit a plan to the KO to avoid or mitigate any such OCI. Note: The KO will unilaterally determine if the Contractor’s plan is acceptable. If the KO determines the plan cannot satisfactorily avoid or mitigate an OCI, s/he may implement other remedies to include prohibiting the Contractor’s further participation in contracted requirements.

3.7 Task 12, Software License Keys: The Contractor shall provide (1) license keys and electronic downloads for software required under this Contract to the COR and (2) software directly to DoDEA schools, districts, or regions only if explicitly required to do so in the contract or in writing by the COR. If applicable.

Requirements / Objectives

The tasks listed above are to help the Contractor gain a better understanding of the requirements and are not all-inclusive. The Contractor is expected to develop a total solution in accordance with a performance-based approach.

4 CONSTRAINTS

4.1 Period and Place of Performance: Base period of one 5-year base period and five option periods, each 12 months long. Work performed at the Contractor’s facilities.

4.2 Holidays and Hours of Operation: Provide synchronous responses to all issues within one business day, except for Federal holidays and Federal government closures/shutdowns.

The following list shows all recognized Federal holidays:

New Year’s Day Labor Day

Martin Luther King Jr.’s Birthday Columbus Day

Presidents Day Veterans Day

Memorial Day Thanksgiving Day

Independence Day Christmas Day

4.3 Availability: The Contractor shall make all resources available for the life of the contract.

4.4 SCORM Compliance: Ensure, where applicable, that all online content for publishing and reusability is SCORM®-compliant. Department of Defense Instruction (DoDI) 1322.26 mandates electronic courseware shall be developed in compliance with the latest possible version of the SCORM® packages, per www.dtic.mil/whs/directives/corres/pdf/132226p.pdf.

4.5 Storage Environment: As noted in 2.1.1 (above), the storage environment for the current LMS is cloud-based and Contractor-hosted. Note: The types of databases currently in use by DoDEA include Cloud solutions, Oracle, and SQL servers.

4.6 Covid 19 Use of Face Coverings: All individuals on DoD Property, installations, and facilities are required to wear a cloth face covering when they cannot maintain six feet of social distance in public areas or work centers.

5 GOVERNMENT-FURNISHED INFORMATION / RESOURCES

5.1 Regarding the migration plan, the Government will respond to questions and provide feedback.

5.2 Regarding implementation, the Government will support the Contractor’s efforts, as stated in the final migration plan.

6 DELIVERABLES

DELIVERABLES FREQUENCY MEDIUM/FORMAT

SUBMIT

TO

Task 7, Meetings, 2.1.7

Post-Award Conference: Participate in a post-award video- or teleconference within five business days after award. Provide minutes in writing in a format acceptable to the COR within two business days after the conference.

IT Meeting: Convene ten business days after award. Provide minutes and medium as stated above.

Other Meetings: As required by the COR.

Provide minutes and medium as stated above.

Email as MS Word/

Excel attachment

COR

Task 1, LMS

Access, 2.1.1

Five business days after post-award conference

Email as MS Word/

Excel attachment

COR

Task 2, Virtual

Professional

Learning, 2.1.2

Present on dates and times determined post-award.

Email as MS Word/

Excel attachment

COR

DELIVERABLES FREQUENCY MEDIUM/FORMAT

SUBMIT

TO

Task 3, System

Migration, 2.1.3

Plan: Draft plan provided to DoDEA ten business days after post-award conference.

Final plan completed five business days after receipt of DoDEA feedback.

Implementation: As specified in the plan.

Email as MS Word/

Excel attachment

COR

Task 4, Onboarding, 2.1.4

Conducted at dates and times agreed upon at the post-award conference.

COR

Task 5, Customization, 2.1.5

Performed in response to specific work orders approved by the Contracting

Officer.

COR

Task 6, Technical

Support and

Maintenance, 2.1.6

Ongoing, beginning on the first day of system implementation

Email as MS Word/

Excel attachment

COR and those who requested assistance

Task 7, Meetings, 2.1.7

Ongoing, beginning with post-award meeting

COR

Task 8, Liaison/Alternate

Liaison, 2.8

Ongoing, beginning at post-award COR

Task 9,Privacy, 3.1 Ongoing COR

Task 10, Optical

Character

Resolution (OCR), 3.3

Upon request Digital OCR COR

Task 11, Technical

Data, 3.4 Upon Request COR

Task 12, Software

License Keys, 3.7 Upon request

Electronic

Download

COR

7 ACRONYMS & DEFINITIONS

College and Career Ready Standards (CCRS)

Contract Line Item Number (CLIN) – Basic structural element in a procurement instrument describing and organizing the required product or service for pricing, delivery, inspection, acceptance, invoicing, and payment.

The use of the term “line item” includes “subcontract line number”, (SLIN), as applicable.

Contracting Officer (KO) – The only individual with expressed authority to obligate (bind) the Government by means of entering, administering, and terminating contracts within the limits of authority delegated via a

Contracting Officer’s warrant.

Contracting Officer’s Representative (COR) – Qualified and trained Government employee, nominated by the requiring activity (RA) and appointed in writing by a KO primarily to perform specific technical or administrative functions on a specific contract(s); serves as the ‘eyes and ears’ of a KO to assure the Government’s best interests are protected via the terms and conditions of the contract(s) appointed. COR’s do not have authority to obligate

(i.e., bind) the Government.

Contractor - Supplier or offeror having a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Department of Defense (DoD / DOD)

Deliverable – Usually anything that can be physically delivered but may include non-physical things such as digital reports.

Defense Federal Acquisition Regulation Supplement (DFARS)

Electronic Information Technology (EIT) – EIT Accessibility Standards (36 CFR part 1194)

Federal Acquisition Regulations (FAR)

Interaction Design (IxD)

In Accordance With (IAW)

Performance Requirements Summary (PRS) – Tabular listing of performance objectives and standards that provides the basis for a meaningful QASP.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions describing the required results in clear, specific and objective terms with measurable outcomes.

Quality Assessment Surveillance Plan (QASP)

Shareable Content Object Reference Model (SCORM)

Technical Exhibit (TE)

User-Centered Design (UCD)

User Interface (UX)

8 PERFORMANCE REQUIREMENTS SUMMARY & QUALITY ASSURANCE

SURVEILLANCE PLAN

7.1 Performance Requirements Summary (PRS)

Performance Standard and

Related Task Acceptable Quality Level Inspection Method Incentives*

* Unless specified otherwise, possible ratings are as follows: exceptional, very good, satisfactory, marginal, or unsatisfactory, per FAR 42.1503, Table 42-1, “Evaluation Ratings Definitions”.

Objective 1, Comprehensive LMS Solution

Task 1, LMS Access, 2.1.1

Five business days after the post-award conference

100% compliance COR inspection and stakeholder feedback

Option year exercise

Task 2, Professional

Learning, 2.1.2

As scheduled post-award

Satisfaction rates reported on the evaluations of the presentations shall not fall below 80%.

COR inspection and stakeholder feedback

Option year exercise

Performance Standard and

Related Task Acceptable Quality Level Inspection Method Incentives*

Task 3, System Migration, 2.1.3

Tasks performed as listed on the final migration plan

Plan: Draft shall be at least

80% complete. Final shall be

100% accurate except for minor errors in grammar, etc.

Implementation: 100% compliance

COR inspection and stakeholder feedback

Option year

Task 4, Onboarding, 2.1.4

Completed ten business days after post-award conference

100% compliance COR inspection and stakeholder feedback

Option year

Task 5, Customization

As determined post-award

100% compliance with task order created in consultation with the

Contractor

COR inspection and stakeholder feedback

Option year exercise

Task 6, Technical Support and Maintenance, 2.1.6

Duration of the award

95% of requests shall be handled in the time limit specified in 2.16

(above).

COR inspection and stakeholder feedback

Option year

Task 7, Meetings, 2.1.7

As stated in the PWS

No more than one meeting per year will need to be rescheduled

COR inspection and stakeholder feedback

Option year exercise

Task 8, Liaison/Alternate

Liaison, 2.8 100% compliance

COR inspection and stakeholder feedback

Option year exercise

Task 9,Privacy, 3.1 100% compliance COR inspection and stakeholder feedback

Option year exercise

Task 10, Optical Character

Resolution (OCR), 3.3 100% compliance

COR inspection and stakeholder feedback

Option year exercise

Task 11, Technical Data, 3.4 100% compliance COR inspection and stakeholder feedback

Option year exercise

Task 12, Software License

Keys, 3.7

100% compliance COR inspection and stakeholder feedback

Option year

7.2 Quality Assurance Surveillance Plan (QASP): The Government will utilize a QASP to monitor Contractor performance on the contract, which can change at any time during the life of the contract.