27R0001_Q_A_101926.pdf

Question # Opportunity Announcement Reference Question Answer

Section 2.2, Mandatory Institutional

Status

What documentation will DoWEA accept as evidence of an active Program Participation Agreement under Section 487 of the Higher Education Act of 1965? If an IHE’s timely recertification application is pending and its existing certification continues under 34 C.F.R. § 668.13(b)(2), what documentation should the IHE provide?

Please submit a copy of your current status depicting your current status. If an IHE is pending due to recertification process include current certiticate and application status document verifying the IHEs status.

Section 3.3, Factor 4, Technical Support and Requirements

Will participants access an IHE’s systems using DoWEA credentials or credentials issued by the IHE? If

DoWEA credentials are required, what identity provider and protocol will DoWEA use, and will DoWEA’s

ClassLink environment support authentication through Microsoft, Google, Apple, or the InCommon

Federation?

Participants will access the IHE’s systems using credentials issued by the IHE.

Section 4.2, Part IV, Technical

Documentation

Should the reference to “Factor 6” in Section 4.2, Part IV, refer to “Factor 4”? The reference to “Factor 6” was incorrect. The Opportunity Announcement has been amended to replace “Factor 6” with “Factor 4.”

4 Sections 1 and 9.1, Government Payment Must a parent or guardian pay the IHE by a specific date or milestone for the payment to be eligible for reimbursement under a separately authorized Government process?

The parent or guardian must pay the IHE by the payment deadline established by the IHE.

Sections 6.2 and 6.3, Rating Method and

Selection Approach

If an IHE proposes multiple delivery models and one model does not meet all applicable requirements, may DoWEA still consider the IHE’s other qualifying delivery models?

An IHE will not necessarily be disqualified in its entirety because one of its proposed delivery models does not meet all applicable requirements. DoWEA may consider other qualifying delivery models if they are clearly distinguished and can be evaluated independently. Any model selected for further discussions must meet all requirements applicable to its proposed scope.

Sections 4.2 and 8, Institutional

Information and Agreement

Administration

Does DoWEA prefer a senior leadership or program-level primary point of contact? DoWEA prefers a program-level primary point of contact who is familiar with the response and can coordinate questions and agreement development. The program-level point of contact may be different from the authorized signing official, who may or may not be a senior leadership official. The authorized official should be identified separately in accordance with Section 4.2, Part I.

Section 3.3, Factor 3, Course Delivery and

Student Admission

Will students register through the selected IHE’s registration system, or will they be required to register through a DoWEA system?

Students will register through the selected IHE’s registration system.

8 Section 2.2, Third-Party Content Providers

How does DoWEA define “third-party content provider”? Does the term include publishers, learning-management systems, technology platforms, transcript or application services, or other IHEs whose content is incorporated into an IHE’s courses, or is it limited to entities that supply or deliver academic course content and assessments?

For purposes of Section 2.2, a “third-party content provider” is limited to an entity that supplies or delivers academic course content or assessments.

Sections 2.3 and 2.4, Service Area and

Ability to Establish an Agreement

Would an IHE entering into an MOU or MOA with DoWEA be exempt from state authorization or licensure requirements, or must the IHE maintain any authorization or licensure required in each jurisdiction where participating students are enrolled?

An IHE entering into an MOU or MOA with DoWEA must be authorized or licensed by the state in which the IHE is located.

Section 3.3, Factor 4, Personnel

Citizenship Requirement

What documentation will DoWEA accept to verify that personnel who will access DoWEA PII or CUI are

U.S. citizens? For example, would an institutional roster accompanied by a certification from the IHE’s human resources office be acceptable?

For purposes of the response, the IHE may submit a roster of personnel who will have access to

DoWEA PII or CUI, accompanied by a certification from an authorized institutional or human resources official confirming that the identified personnel are U.S. citizens. DoWEA may request additional supporting documentation during technical review or agreement development.

Section 2.2 and Attachments A and G, Third-Party Content Providers

Must each third-party content provider possess its own Program Participation Agreement? If a provider does not participate in Title IV programs or possess a PPA, how should the IHE identify and document that provider? Would DoWEA accept the IHE’s active PPA together with provider-specific privacy and security documentation, such as an NDPA or SOC 2 Type II report?

No. A third-party content provider is not required to possess its own Program Participation Agreement

(PPA) solely because it provides content or services to the IHE. The IHE must maintain an active PPA and remains responsible for performance under the agreement. The IHE must identify each provider by legal name; describe the provider's role, services, systems, locations, subcontractors, and access to student or government data; and state whether the provider performs any Title IV function. If a provider performs a function that makes it a third-party servicer under 34 C.F.R. § 668.2 and § 668.25, the IHE must document and report that relationship as required by the U.S. Department of Education.

DoWEA may consider the IHE's active PPA together with provider-specific privacy and security evidence, including an NDPA, SOC 2 Type II report, data-flow description, incident-response terms, and subcontractor controls. Those materials are supplemental and do not replace the IHE's PPA, applicable

Title IV requirements, or DoWEA's technical and legal review.

Section 3.3, Factor 4, U.S.-Based Data

Hosting

Does the U.S.-based data-hosting requirement permit participants to access courses from outside the

United States if hosting and data storage remain within the United States? Are there any restrictions on processing, transmission, or temporary caching outside the United States, and to what data would those restrictions apply?

Yes. Participants may access courses while located outside the United States, provided the solution's production hosting, authoritative data stores, backups, disaster-recovery copies, administrative processing, and provider-managed caching of DoWEA data remain within the United States. Ordinary encrypted network transit through non-U.S. infrastructure and temporary caching on an authorized participant's endpoint do not, by themselves, constitute non-U.S. hosting; however, the provider must not intentionally persist, replicate, inspect, or process DoWEA PII or CUI outside the United States. The

IHE must identify all hosting, content-delivery, support, logging, telemetry, backup, and subprocessors that may store or process covered data and describe controls for access from outside the United

States. Any exception requires prior written DoWEA approval.

13 Section 3.3, Factor 4, PII and CUI

What information will DoWEA treat as PII or CUI for purposes of the personnel citizenship requirement? Will DoWEA identify the applicable CUI categories and provide an authoritative data inventory or classification identifying the covered information?

For this requirement, PII includes information that can distinguish or trace an individual, alone or when combined with other linked or linkable information. Examples include names, personal identifiers, contact information, account credentials, dates of birth, enrollment information, grades, transcripts, educational records, financial information, accessibility information, and system or audit data linked to an individual. CUI means government-created or government-possessed information, or information created or possessed for or on behalf of the Government, that requires safeguarding or dissemination controls under law, regulation, or government-wide policy and is included in the National CUI Registry.

DoWEA will identify known data elements, applicable CUI categories, and handling requirements during technical review and agreement development, as applicable. The IHE must also provide and maintain a current data inventory and data-flow diagram; it may not rely on the absence of an exhaustive government inventory to exclude information that meets the applicable PII or CUI definition. The personnel requirement applies to personnel who can access, administer, support, process, or retrieve covered PII or CUI, including through privileged access, logs, backups, or support tools.

Section 3.3, Factor 4, Personnel

Citizenship Requirement

In place of U.S.-citizenship verification, would DoWEA consider an IHE’s personnel-vetting and security controls for employees who are authorized to work in the United States? If so, what additional screening, access restrictions, or security controls would be required?

The IHE may describe its proposed personnel-vetting and security controls in its response, including the personnel and data involved, proposed access limitations, and supporting safeguards. DoWEA will evaluate the proposed approach during technical review and agreement development. Review of the proposed approach does not constitute acceptance or approval. No, not as an automatic substitute.

Authorization to work in the United States and employer vetting do not establish U.S. citizenship. If the solicitation or agreement expressly requires U.S. citizenship for personnel with access to covered

PII or CUI, the IHE must comply unless DoWEA modifies or waives that requirement in writing through the authorized acquisition or agreement process. The IHE may propose an alternative approach that identifies the affected personnel and data and includes, at a minimum, identity and employment verification, role-based and least-privilege access, separation of duties, U.S.-based privileged administration, multifactor authentication, device and session controls, logging and monitoring, background screening appropriate to the risk, subcontractor flow-downs, incident reporting, access recertification, and immediate termination of access when no longer required. DoWEA may evaluate the proposal during technical review and agreement development, but submission or review does not constitute acceptance, approval, or a waiver of the stated requirement.

15 Section 3.3, Factor 4, De-Identified Data

Would personnel who cannot access identifiable records, re-identification keys, or CUI be permitted to use de-identified, aggregated, synthetic, masked, or tokenized data without satisfying the citizenship requirement? If so, what de-identification standards and access controls would apply?

The IHE may propose an approach under which personnel are limited to de-identified, aggregated, synthetic, masked, or tokenized data. The response should describe the data involved, de-identification methods, access restrictions, separation from source records or re-identification keys, and applicable safeguards. DoWEA will determine the acceptability of the proposed approach during technical review and agreement development.

Sections 3.3, 4.1, and 6, Factor 4 and

Response Review

If an IHE cannot meet the personnel citizenship requirement at the time of submission, may the IHE submit a compliance plan or alternative risk-mitigation approach for DoWEA’s consideration? Would noncompliance at submission preclude further consideration?

Failure to meet this requirement as written at the time of submission will not preclude DoWEA from reviewing the response. The IHE may submit a proposed compliance plan or alternative risk-mitigation approach for DoWEA’s consideration. The response should clearly identify the limitation and describe the proposed approach and implementation. Acceptance of any proposed approach will be determined during the review and agreement-development process.

Questions and Answers

HE125427R0001 - Dual Enrollment Partnership Opportunity Announcement

Section 3.3, Factor 4, Alternative Security

Controls

May an IHE propose a tailored personnel-security approach using controls such as data segmentation, role-based access, minimum-necessary access, personnel screening, supervisory approval, access logging, periodic access reviews, and restrictions on downloading or exporting data? If so, what supporting documentation should the IHE include in its response?

The IHE may include a proposed tailored personnel-security approach in its response. The response should identify the affected personnel and data, proposed access limitations and controls, implementation timeline, and supporting policies or documentation. DoWEA will evaluate the proposed approach during technical review and agreement development.