26QE011_Attach10_QA_031026 1.pdf

Question # Question Answer

Based on the NAICS and PSC code of the solicitation is the government looking for a technical solution? For example how does the government determines screeners? Is the idea that you will give the students paper screeners based on the NAICS code being book publishers?

Yes the screeners will be given to students, review PWS 2.1.2:Screeners: valid, reliable, evidence-based, self-reporting instrument (completed by students) which can be used by school psychologists, school counselors, and school nurses to screen for suicide risk factors and suicide ideation. The proposed instrumentshall be aligned to the instructional resources, be a validated measure that has demonstrated evidence of its effectiveness in identifying students at risk of committing acts of self-harm or suicide, bedigitally accessible, and be age and developmentally appropriate.

2 What is your user flow with ClassLink? How do you envision this to work DoDEA utilizes Classlink as a single sign on solution. The user clicks ClassLink, selects the tile for the program they are accessing, and begins using the selected program.

Regarding the 508 compliance requirements, are the compliance requirements intended for the students who are seeing the program or the teachers who are implementing it?

The 508 compliance applies for both.

Since FedRAMP authorizations are defined as Low, Moderate, or High impact levels, can DoDEA clarify whether the requirement refers to FedRAMP Moderate authorization supporting DoD Impact Level 2 (IL2) data, or another security baseline?

For DoWEA, the typical requirement is FedRAMP Moderate with alignment to DoD Impact Level 2 (IL2) for systems handling non-sensitive DoD information. If the system processes PII or other controlled data, additional controls consistent with IL4 or an Authorizing Official risk acceptance may be required.

HE125426QE011 DoDEA Grades 6-12 Suicide Prevention Instructional Resources

If authorization is not required at award, what documentation should Offerors include in their proposals to demonstrate compliance readiness (e.g., system architecture diagrams, security control documentation, vulnerability scan results, POA&M, incident response plan, or similar artifacts)?

If authorization is not required at the time of award, Offerors should include documentation that demonstrates readiness to meet DoW/DoWEA security and RMF requirements. This may include:

System architecture and data flow diagrams showing the hosting environment and how DoW/DoWEA data is processed and protected

Security control documentation aligned to NIST SP 800-53 / FedRAMP Moderate controls

Evidence of an existing FedRAMP authorization or progress toward authorization, if applicable

Vulnerability scan results and current Plan of Action and Milestones (POA&M)

Incident Response Plan and continuous monitoring approach

Any existing ATO, FedRAMP package, or third-party security assessments

These artifacts help demonstrate that the Offeror’s environment is capable of meeting DoW/DoWEA RMF and cloud security requirements and can obtain the necessary authorization prior to processing DoD information.

What is the formal process for requesting a waiver of the FedRAMP requirement (e.g., required documentation, approval authority, and expected review timeline)? If a waiver is granted, would it be time-bound or contingent upon achieving specific compliance milestones?

Requests for a waiver of the FedRAMP requirement typically must be submitted in writing through the appropriate RMF channels to the DoDEA cybersecurity authority and Authorizing Official (AO) with with coordination through the RMF/Information System Security Manager (ISSM). The request should include a justification explaining the mission need and why a FedRAMP-authorized solution is not feasible, along with supporting documentation such as system architecture and data flow diagrams, security control documentation aligned with NIST SP 800-53, a risk assessment, vulnerability scan results, a Plan of Action and Milestones (POA&M), and incident response and continuous monitoring plans. The AO reviews the request to determine whether the risk is acceptable. If approved, the waiver is generally time-bound and may be contingent upon achieving specific compliance milestones, such as implementing compensating controls or obtaining a FedRAMP authorization or DoD Impact Level–aligned ATO within a defined timeframe.

Does DoDEA require the screener and associated instructional resources to be hosted within contractor-managed systems, or may Offerors implement solutions that operate within existing DoDEA-managed platforms or environments (e.g., Schoology or ClassLink), provided all functionality and accessibility

The PWS does not require the screener to be hosted on the contractor-managed system.

If the solution operates entirely within DoDEA-managed systems and the vendor does not host, process, or store DoDEA data in a contractor-managed cloud environment, would the FedRAMP requirements referenced in Technical Exhibit #1 still apply?

If the solution operates entirely within DoWEA-managed systems and infrastructure, and the vendor does not host, process, or store DoWEA data within a contractor-managed cloud environment, the FedRAMP requirements would generally not apply to the vendor solution itself. FedRAMP applies specifically to cloud service providers offering services to the federal government. In this scenario, the security controls would instead fall under DoWEA’s existing RMF authorization boundary and security controls for the government-managed environment. However, the vendor would still be required to comply with applicable DoW cybersecurity requirements, data protection policies, and integration security controls to ensure the solution does not introduce risk to the authorized DoWEA environment.

For COTS instructional resources, does DoDEA require research studies specific to the exact COTS configuration, or may Offerors provide research supporting the underlying curriculum, instructional methodology, or validated program model? Additionally, to ensure cultural relevance for DoDEA’s diverse student population and locations, may Offerors provide limited contextual adaptations (e.g., examples, discussion prompts, or facilitator guidance tailored to DoDEA environments), provided the core evidence-based curriculum and screening instruments remain unchanged?

For the COTS instructional resource configuration, DoDEA requires research studies specific to the the COTS. Yes, limited contextual adaptations etc provided the core curriculum and screening instrument remain unchanged is acceptable.

Does DoDEA require the entire proposed solution (instructional content, screener, and delivery environment) to be supported by research as a single integrated program, or is it acceptable for individual components of the solution (e.g., curriculum methodology, screening instrument, or delivery framework) to have independent research support demonstrating effectiveness?

Dodea requires the proposed solution to be research supported as a single integrated program.

Given the ethical, privacy, and statistical constraints associated with measuring suicide outcomes among minors, will DoDEA consider research demonstrating statistically significant improvements in recognized suicide prevention indicators (e.g., increased help-seeking behavior, improved recognition of warning signs, or earlier identification of at-risk students) as acceptable evidence of effectiveness?

No, the evidence of effectiveness must include reduction of student suicides and attempts.

HE125426QE011_ Attach10_QA