IES DR-RUD Draft PWS.pdf

U.S. Department of Education Institute of Education Sciences

Draft Performance Work Statement (PWS) IES Data Repository and Restricted Use Data Program (DR-RUD)

DR-RUD

September 12, 2025

Table of Contents Table of Contents

1. Introduction

2. Legislative Authority

3. Purpose of Scope of Work

4. Requirement Context

5. General Information

5.1 Period of Performance

5.2 Place of Performance

5.3 Contract Type

6. Scope of Work

6.1 Task 1: Post Award/Annual Option Year Meetings | Non-Optional

6.2 Task 2: Data Stewardship, Project Management and Reporting | Non-Optional

6.3 Task 3: Subject Matter Expertise

6.4 Task 4: Export and Export Review | Non-Optional

6.5 Task 5: Additional Export Reviewer Seats | Optional

6.6 Task 6: CIPSEA and ESRA Training

6.7 Task 7: IT System Security Compliance

7. Key Personnel/Staff Qualifications

8. Quality Control and Assurance

9. Additional ED and Federal-Wide Requirements

9.1 Records and Controlled Unclassified Information (CUI) Requirements

9.2 IT Accessibility Requirements (Section 508 of the Rehabilitation Act)

9.3 Security Clearance Requirements

9.4 Additional Information System Requirements

10. Data Ownership, Rights, and Custody

10.1 Data Storage

10.2 Confidential Treatment of Sensitive Information

11. Attachments

11.1 Attachment B. Quality Assurance Surveillance Plan (QASP)

1. Introduction The Institute of Education Sciences (IES) is the statistics, research, and evaluation arm of the U.S. Department of Education (ED). The goal of IES is to provide national leadership in expanding fundamental knowledge and understanding of education from early childhood through postsecondary study, in order to provide parents, educators, students, researchers, policymakers, and the general public with reliable information about the condition and progress of education in the United States, from early childhood through postsecondary education; educational practices that support learning and improve academic achievement and access to educational opportunities for all students; and the effectiveness of federal and other education programs.

The Education Sciences Reform Act (ESRA, Title I of P.L. 107-279) established IES as an independent research arm of ED. Title I, Part A, of ESRA establishes IES as a research institute within ED, intended to provide “national leadership in expanding fundamental knowledge and understanding of education from early childhood through postsecondary study.” IES is authorized to carry out these objectives by compiling statistics, conducting research and evaluations, and disseminating information.

IES executes its mission through four national education centers and an Office of the Director:

• The National Center for Education Research (NCER) sponsors research leading to the accumulation of knowledge and understanding of education.

• The National Center for Education Statistics (NCES) collects and analyzes education information and statistics in a manner that meets the highest methodological standards.

• The National Center for Education Evaluation and Regional Assistance (NCEE) supports evaluation, technical assistance, development, and dissemination activities.

• The National Center for Special Education Research (NCSER) sponsors research to expand knowledge and understanding of the needs of infants, toddlers, and children with disabilities.

• The Office of the Director carries out specific duties, such as proposing research priorities and establishing procedures for technical and peer review. The Standards and Review Office (SRO) carries out rigorous peer review of all research, statistics, and evaluation reports conducted by, or supported through, the Institute and falls under the Office of the Director.

2. Legislative Authority Section 154 of ESRA allows the NCES Commissioner to “enter into contracts” to carry out his or her duties under ESRA Part C. Those duties include the dissemination of statistical data (Section 151 of ESRA) and providing copies of “statistical records ... for State and local officials, public and private organizations, and individuals” (Section 156(a)(1) of ESRA).

Notably, those authorized activities must be done in a manner that preserves the confidentiality of statistical data (see ESRA Section 183 and the Confidential Information Protection and Statistical Efficiency Act).

3. Purpose of Scope of Work This requirement enables researchers to seek and obtain secure, remote access to approved IES Restricted Use Data (RUD), most notably data from NCES and NCEE, for approved research projects. Secure, remote access to these data strengthens the evidence base for policymakers and educators while enhancing the security of restricted use data assets.

4. Requirement Context This requirement contributes to IES’s and ED’s mission to promote evidence-building for policymakers and the education field. Ensuring researchers’ secure, remote access to RUD fulfills IES’s mission to provide evidence to guide education practice and policy, with a focus on improving student outcomes, while meeting IES’s responsibilities to protect confidential information collected for statistical purpose.

Secure, remote access to a subset of restricted use datasets has been successfully provided by an organization currently under contract. Originally, the organization provided secure access to IES Restricted Use License holders under a contract administered by the National Science Foundation that included support for IES requirements. Now, IES has a separate, short-term contract with that same vendor to serve as a “bridge” during this acquisition process.

Another subset of users continue to access RUD with physical media, such as CD-ROMs. All activities related to physical media are managed via a separate IES contract and contractor. IES seeks to improve the security of its RUD program by transitioning all physical licensees to remote access for their approved data by September 30, 2026.

This requirement supports NCES’ transition to a fully digital Restricted Use Data License program through the use of a virtual data enclave, overseeing the eventual removal physical media with RUD from circulation, and running key aspects of the RUD license application process to expand secure, remote access to new users and new data.

Historically, the RUD license application process—for both remote access and access to physical media—has had the following steps:

1. A user submits their application via the Standard Application Process (SAP) at researchdatagov.org;

2. The application is downloaded from the SAP by an existing IES contractor to an existing internal license tracking database;

3. Applications are reviewed by the IES contractor for their completeness and accuracy;

4. Subject matter experts at IES familiar with the requested data review the proposed research plan to ensure that it can support the requestor’s research needs;

5. IES leadership approves the new license and access to data is provided.

Applicants may apply for multiple datasets under a single license, and multiple users may be associated with a license depending on how research activities are to be conducted (e.g., a faculty member may be the license-holder, and his or her graduate research assistances may be “additional users” for the purpose of completing one or more projects.) The license database is regularly updated to reflect such changes.

Finally, when research outputs are prepared, they must be reviewed by IES (or its designee) for compliance with standards designed to prevent inadvertent disclosure of confidential information. This process is referred to as Disclosure Risk Review. Historically, researchers transmit proposed manuscripts, presentations, or equivalent to IES DRR reviewers who then evaluate materials for disclosure risk and request edits as needed. Only once the DRR review process is successfully completed can research be findings shared with individuals not on the submitter’s license. Presently, license holders who have virtual access to RUD have exports from the enclave preliminarily reviewed by enclave staff to ensure there are no immediate disclosure risks prior to eventual submission to IES for a formal review.

5. General Information

5.1 Period of Performance

The period of performance for this requirement is One, 12-month base period, with four, 12-month option periods.

Table 1 - Period of Performance (Required)

Contract Year Dates

Base Period 1/1/2026 – 12/31/2026

Option Period 1 1/1/2027 – 12/31/2027

Option Period 2 1/1/2028 – 12/31/2028

Option Period 3 1/1/2029 – 12/31/2029

Option Period 4 1/1/2030 – 12/31/2030

5.2 Place of Performance

Performance will occur entirely at the contractor’s place(s) of business. No access will be provided to ED facilities.

5.3 Contract Type

Firm-Fixed Price

6. Scope of Work

6.1 Task 1: Post Award/Annual Option Year Meetings | Non-Optional

Subtask 1a: Contract Kick-Off Meeting Within one (1) week of contract award in the base year and all exercised option years, the contractor shall conduct a kick-off meeting at the government location if conditions allow, otherwise the meeting will be held virtually using an electronic meeting platform. A detailed meeting agenda shall be circulated no later than 48 hours prior to the meeting. The agenda will list items to be discussed and the time allotted for each item. Within 24 hours of the meeting, a final agenda will be published and circulated to all invitees. A completed meeting minutes template, which combines the meeting agenda with minutes and action items, will be disseminated to all invitees within one (1) week after the meeting.

Subtask 1b: Support for the IES Restricted-Use Data License Application The contractor must establish, in coordination with the COR, regular weekly communications to take place on an online platform approved by the Department. The contractor must plan for an online meeting monthly with IES of approximately 75 minutes in length.

Table 2: Deliverables for Task 1

Deliverable No.: Deliverable Name

Deliverable Due Date Period of Performance

1.1 Kickoff Meeting

Agendas and Notes

Agendas to be provided two (2) days prior to meeting; meeting to be scheduled within one week of award

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

1.2 Kickoff Meeting

Minutes

Within one (1) week of kick-off meeting

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

Deliverable No.: Deliverable Name

Deliverable Due Date Period of Performance

1.3 Monthly Meeting

Agendas and Notes

Monthly, to begin the week after kick-off.

Base Period

Option Period 1

Option Period 2

6.2 Task 2: Data Stewardship, Project Management and Reporting | Non- Optional

The contractor shall host a data repository (DR) for IES Restricted Use datasets. The contractor shall ingest and host all data currently available in IES’s existing data repository (roughly 320 data sets, with an average file size of 850MB). The contractor should be prepared to ingest an additional 60 data sets by September 30, 2026. Following that date, the contractor should be prepared approximately 5 data sets per year. IES anticipates bearing the cost of this data infrastructure.

IES anticipates that up to five thousand users will be granted access to the DR at any given time.

Each user must have a separate, private workspace that allows for the storage of statistical code and work product as well as provisioned access to the data file(s) to which they have been approved by IES to access. The contractor will permit secure researcher access to said datasets only after receiving notification from NCES that such access has been approved and shall revoke such access upon demand.

IES anticipates that the cost associated with a user workspace will be born by the user themselves. As such, the contractor should develop and administer an overall pricing model that achieves that goal. Importantly, IES acknowledges that not all users have the same financial resources, and that a high per-user cost may prevent some users from accessing the DR. As such, the contractor’s pricing model may be differentiated so that it permits reasonable access to RUD to all qualified researchers. The original model should be clearly articulated in the contractor’s initial business proposal; it should be updated following the project Kick-Off meeting and annually thereafter.

The contractor shall provision the enclave with statistical software appropriate to the analysis of quantitative, complex survey data. This should include open source (e.g., R, python) and non-open source (e.g., Stata) software solutions. The contractor is responsible for purchasing and maintaining licenses for such software in the most cost-effective manner possible.

The contractor shall implement such project management processes as are needed to ensure the timely achievement of the government’s requirements and shall document the same as required in the table of deliverables listed below.

Table 3: Task 2 Deliverables

Name

Deliverable Due Date Period of Performance

2.1 Pricing Model Revision within 2 weeks of kickoff

meeting; updated annually thereafter.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

2.2 Monthly Update

Meeting Agendas and Notes

Agendas to be provided 2 days prior to meeting; meetings shall occur on a monthly cadence, such as January 15, February 15, …, December 15, 2026.

Option Period 2

Option Period 3

Option Period 4

2.3 Monthly Reports Monthly cadence beginning in January, Base Period

Option Period 1

Option Period 2

6.3 Task 3: Subject Matter Expertise

The contractor must recruit Subject Matter Experts (SME) who possess sufficient knowledge to make determinations regarding the feasibility of research projects proposed by applicants (see “Requirement Context” above).

This requires expertise in the NCES data collections below (as a group of SMEs) as well as knowledge of high-quality education and/or behavioral research using sample-survey of similar data (as individual SMEs).

Given the data currently available to be licensed, expertise must be maintained across the areas of:

a. National Teacher Principal Survey (NTPS) and Schools and Staffing Survey (SASS)

b. National Postsecondary Student Aid Study (NPSAS), Baccalaureate and Beyond

Longitudinal Study (B&B), Beginning Postsecondary Study (BPS)

c. Early Childhood Longitudinal Study (ECLS) and National Household Education Surveys Program (NHES)

d. Middle Grades Longitudinal Study (MGLS) and High School & Beyond (HS&B)

e. National Assessment of Educational Progress (NAEP)

f. Civil Rights Data Collection (CRDC)

g. Trends in International Mathematics and Science Study (TIMSS), Program for

International Student Assessment (PISA),

h. Private School Survey (PSS) and Common Core of Data (CCD)

Table 4: Deliverables for Task 3

Deliverable No.: Deliverable Name Deliverable Due Date Period of Performance

3.1 Documentation of

Subject Matter Experts’ Skills, Knowledge, Training and/or Experience

Within one (1) week of award, and then updated when SMEs are added or removed from the contract

Base Period

Option Period 1

Option Period 2

6.4 Task 4: Export and Export Review | Non-Optional

The DR shall prevent users from exporting content prior to review. Contractor shall review all outputs generated from restricted use data, and implement such technologies and processes as are needed to ensure such outputs are not exported from the DR until their compliance with those NCES statistical standards designed to prevent the disclosure per personally-identifiable information is fully met (see https://nces.ed.gov/statprog/).

Unless otherwise and specifically permitted by NCES, the contractor must review each export within 30 days of submission by the user.

The contractors shall, as described below, provide a summary of export reviews to the government monthly as a component of its monthly report.

Table 5: Task 4 Deliverables https://nces.ed.gov/statprog/

Deliverable Due Date Period of Performance

4.1 Summary of

Export Reviews

Monthly, the contractor shall list each export review conducted, including the associated user, data file, date the review was received, date the review was completed, and the elapsed time of the review.

Base Period

Option Period 1

Option Period 2

6.5 Task 5: Additional Export Reviewer Seats | Optional

The contractor shall provide login access to the DR for 10 government-specified users for the purpose of verifying export reviews conducted by the contractor in Task 2 above.

The contractors shall provide training to said users on the proper use of the DR for verification of export reviews.

Table 6: Task 5 Deliverables

Deliverable No.: Deliverable Name

Deliverable Due Date Period of Performance

5.1

Logins & training materials for up to 10 users

Within one week of award Base Period

Option Period 1

Option Period 2

6.6 Task 6: CIPSEA and ESRA Training

The contractor shall be responsible for developing training materials regarding the responsibilities of using data protected by CIPSEA and/or ESRA. The contractor should consider the extent to which those training materials might differ between three intended audiences: (a) IES staff, (b) restricted use license applicants, and (c) existing restricted use licensees.

The contractor shall also be responsible for designing and implementing a program that ensures audiences (a) and (c) above complete relevant training annually, and maintain records associated with training completion.

Table 7: Task 6 Deliverables

Deliverable Due Date Period of Performance

6.1 Training Plan, detailing proposed training modules, content, and audiences

Within 2 months of the contract award Base Period

6.2 Training

Materials

Within 6 months of the award of the contract

Base Period

6.3 Training Status

Update, identifying to IES any individuals who have failed to complete annual training requirements.

September 30, 2026

September 30, 2027

September 29, 2028

September 28, 2029

September 30, 2030

Option Period 2

6.7 Task 7: IT System Security Compliance

To ensure the protection of Department of Education (ED) information and systems, all contractors and their personnel performing work for ED must strictly adhere to a comprehensive set of federal and Department-specific security requirements. These mandates, detailed on the official ED website, cover areas such as personnel security, IT system security, privacy, incident reporting, and data handling, all designed to safeguard sensitive data and maintain the integrity of ED's operational environment. Contractors are responsible for implementing robust security controls, complying with federal regulations and ED policies, and ensuring their systems and practices meet the stringent standards necessary for working with federal information. This Performance Work Statement further details the specific technical and procedural security obligations required for the successful execution of this contract.

Per the Federal Information Security Modernization Act (FISMA) and supporting Department of Education Regulation (EDAR) 3452.239-71 Department Information Security and Privacy Requirements (https://www.acquisition.gov/edar/3452.239-71-department-information-security-and-privacy-requirements.?searchTerms=3452.239-71), the Contractor, and all sub-contractors, shall comply with the Department of Education’s IT security policy requirements, specifically https://www.acquisition.gov/edar/3452.239-71-department-information-security-and-privacy-requirements.?searchTerms=3452.239-71 https://www.acquisition.gov/edar/3452.239-71-department-information-security-and-privacy-requirements.?searchTerms=3452.239-71 those set forth in the Security Requirements for Contractors Doing Business with the Department of Education (https://www2.ed.gov/fund/contract/about/bsp.html). Additionally, the contractor, and all sub-contractors, shall develop and implement management, operational and technical security controls to assure required levels of protection for information systems. Furthermore, the contractor, and all sub-contractors, shall further comply with all applicable Federal IT security requirements including, but not limited to:

• Office of the Chief Information Officer’s (OCIO) Personally Identifiable Information (PII) Processing and Transparency Standard

• Departmental Directive ACSD-OPEPD-002 Personally Identifiable Information Breach Response Policy and Plan

• Appendix III to Office of Management and Budget (OMB) Circular A-130

• Most recent applicable National Institute of Standards and Technology (NIST) special publications, standards and guidance Any new information system intended for operation, and subsequent authorization, within the Department of Education (ED) environment shall first undergo and receive approval through the Department's Enterprise Architecture Technology Insertion (EATI) process. This EATI approval is a prerequisite that provides a risk evaluation for initial use/authorization that will then guide the subsequent detailed system authorization process, as supported by the technical requirements outlined in this Performance Work Statement (PWS). The EATI approval memo will explicitly define the timeline for the Contractor to complete all aspects of the authorization process as well as any specific requirements noted by each approval authority as it relates to security and/or privacy. Strict adherence to this timeline is critical, as failure to meet the specified requirements will result in significant implications for the system's authorization status, risk scorecard, and may negatively impact the associated program office.

Subtask 7.1: Rapid Risk Assessment (RRA) Requirements Prior to initial authorization as part of the EATI process, the Contractor shall ensure the new system is prepared to address and demonstrate compliance with critical security controls during the Rapid Risk Assessment (RRA). This readiness includes, but is not limited to, the following areas:

1. System Registration within CSAM:

a. The Contractor shall ensure that all points of contact for the system are accurately recorded and maintained within the Governance, Risk, and Compliance Tool (GRCT), formerly known as Cybersecurity Assessment and Management

(CSAM).

https://www2.ed.gov/fund/contract/about/bsp.html

b. The Contractor shall ensure that the FIPS 199 Categorization for the system's impact level (Confidentiality, Integrity, Availability) is completed and documented within CSAM.

c. The Contractor shall also document and verify all hosting locations, including Cloud Service Providers (CSPs), primary data centers, and disaster recovery (DR) sites, along with their respective management offices, primary, and alternate locations within the CSAM system profile.

2. Vulnerability and Compliance Scanning: The system shall demonstrate active and effective vulnerability and compliance scanning processes and provide the ability for the results to be ingested into the Department cyber data lake solution.

3. Encryption: The system shall implement robust encryption for both data in transit and data at rest.

4. Audit Log Capabilities: The system shall possess comprehensive audit logging capabilities, capturing relevant security events in accordance with M-21-31.

5. Audit Correlation Capabilities: The system shall support the correlation of audit logs to facilitate security incident detection and provide the ability for the logs to be ingested into the Department security information and event management (SIEM) solution.

6. Multifactor Authentication (MFA): The system shall implement multifactor authentication for all access (e.g., users, administrators) to the information system and outlined within a digital identity risk assessment (DIRA).

7. Trusted Internet Connection (TIC) 3.0: The system's external network connections shall adhere to Trusted Internet Connection (TIC) 3.0 guidelines and requirements.

The above requirements must be adequately addressed no later than 30 calendar days prior to planned timeline for the information system to become operational within the ED environment (“go live” date) to allow the Security Assessment Team the necessary time to perform an authorization assessment, collaborate with the necessary security and privacy stakeholders, and ultimately work with the EATI chair/Authorizing Official to issue the initial authorization.

Subtask 7.2: Technical Requirements for System Authorization The Contractor shall adhere to the following technical requirements to ensure comprehensive documentation, security posture, and compliance for all new system authorizations. The Contractor shall have the associated authorization documentation as outlined below completed no later than three (3) months after contract award.

7.2.1. System Security Plan (SSP)

The Contractor shall generate (automatically generated from Department GRC Tool) and maintain a System Security Plan (SSP) that meets the following criteria:

• The SSP shall comply with the ED System Security Plan Checklist.

• The SSP shall include a detailed system description and boundary.

• The SSP shall provide a comprehensive hardware list of all components within the system boundary.

• The SSP shall provide a comprehensive software list of all applications and operating systems utilized by the system.

• The SSP shall include a complete ports, protocols, and services list for the system.

• The Contractor shall ensure that control inheritance documented in CSAM accurately aligns with the SSP narratives, system architecture, and defined system boundary (e.g., General Support System (GSS) and/or Cloud Service Provider (CSP) inherited controls).

• The Contractor shall input implementation statements in CSAM for all applicable security controls, including both hybrid and system-specific controls.

• The Contractor shall validate and provide justification for any "Not Applicable" controls or statements set by the user within CSAM.

7.2.2. Agreements

The Contractor shall identify and document all relevant Interconnection Security Agreements (ISAs) and Memorandums of Understanding/Agreements (MOUs/MOAs) pertaining to the new system's interfaces and data exchanges with other systems or entities.

7.2.3. Required Documents

The Contractor shall develop, maintain, and provide the following essential system documentation:

• Incident Response Plan (IRP) o The Contractor shall execute and provide a System Incident Response Test Report demonstrating the effectiveness of the system's Incident Response Plan.

• Contingency Plan (CP) o The Contractor shall execute and provide the following test reports demonstrating the effectiveness of the system's Contingency Plan:

• System Contingency Plan Test Report

• Disaster Recovery Plan Test Report (if applicable)

• Configuration Management Plan (CMP)

7.2.4. Plan of Action and Milestones (POA&M)

The Contractor shall manage and report on the system's security posture through the following:

• The Contractor shall ensure that a self-assessment is completed and recorded within the Control Validation section of CSAM.

• The Contractor shall ensure that Open POA&Ms are created and maintained in CSAM for all identified deficiencies that are planned for remediation or are not yet in place.

• The Contractor shall provide all necessary Risk Acceptance Packages for any identified risks requiring formal acceptance.

7.2.5. Vulnerability Scan Results

The Contractor shall conduct and provide evidence of timely vulnerability and compliance scanning (every 48 hours or less) for the system's components in accordance with CISO Memo Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive 23-01:

Improving Asset Visibility and Vulnerability Detection on Federal Networks:

• Network and endpoint device vulnerability scan results shall be provided, with scans conducted no more than 31 days prior to authorization activities. Following initial authorization, the system must maintain the capability to perform on-demand vulnerability enumeration and automated scanning, with results provided to the Government within 48 hours of a request.

• Operating system vulnerability scan results shall be provided, with scans conducted no more than 31 days prior to authorization activities. Following initial authorization, the system must maintain the capability to perform on-demand vulnerability enumeration and automated scanning, with results provided to the Government within 48 hours of a request.

The Contractor shall conduct and provide evidence of timely vulnerability and compliance scanning (every 48 hours or less) for the system's components in accordance with the Vulnerability Scan Frequency Requirements outlined in the Information Technology (IT) Risk Assessment (RA) Standard:

• Application vulnerability scan results shall be provided, with scans conducted no more than 31 days prior to authorization activities. Following initial authorization, the system must maintain the capability to perform on-demand vulnerability enumeration and automated scanning, with results provided to the Government within 48 hours of a request.

• Database management system vulnerability scan results shall be provided, with scans conducted no more than 31 days prior to authorization activities. Following initial authorization, the system must maintain the capability to perform on-demand vulnerability enumeration and automated scanning, with results provided to the Government within 48 hours of a request.

7.2.6. Privacy Documentation

The Contractor shall work with the Privacy Office to ensure all necessary privacy documentation is created or modified, as applicable, including:

• Privacy Threshold Analysis (PTA)

• Privacy Impact Assessment (PIA)

• System of Records Notice (SORN)

7.2.7. Document Templates

To facilitate prompt completion of the above requirements in the Department-preferred format, templates for the documentation have been provided in the attached zip file.

ED Authorization Documentation.zip

7.2.8 Federal Risk and Authorization Management Program (FedRAMP) Requirements (if applicable)

For systems leveraging a FedRAMP authorized cloud service offering, the Contractor must understand that FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. While FedRAMP authorization significantly streamlines the security process, it does not represent a full authorization to operate (ATO) within the Department of Education's environment. The Contractor is contractually obligated to thoroughly review and address all customer responsible controls as identified in the associated Customer Responsibility Matrix (CRM) for the specific FedRAMP product being utilized. Simply stating that a system is FedRAMP authorized is insufficient; the Contractor shall document how each customer responsible control is sufficiently implemented and validated for the identified information system, ensuring alignment with Department-specific security policies and requirements. This ensures a complete security posture tailored to ED's operational context and risk appetite.

7.2.9 Technical Requirements for Information Security Continuous Monitoring (ISCM)

Upon completion of all technical requirements and initial authorization, the system will transition into the Department's continuous monitoring and security authorization program. This is not the end of the security process, but rather a shift to ongoing oversight. The purpose of this program is to ensure the system maintains its security posture over time, adapting to new threats and vulnerabilities. Continuous monitoring involves regular assessments, vulnerability scanning, compliance scanning, and control validation to confirm that the system remains compliant with all security policies and standards. This proactive approach ensures the system's continued protection of Department data and resources throughout its entire lifecycle.

As part of the OSA Program, the contractor is responsible for the following actions:

1) The information system must maintain its current system configuration throughout the course of the assessment to maintain consistency of assessment results.

a) The SAT must be notified in advance that a configuration change is required during the security assessment activities to permit the appropriate modifications to the overall security assessment schedule.

2) System stakeholders must manage and maintain a list of CSP or GSS leveraged services within the system or technical description and the CSAM software inventory.

3) Information system stakeholders will be available for interviews and information system walkthroughs/demonstrations.

4) Designated information system stakeholders are responsible for requesting all applicable and appropriate authenticated scans (e.g., vulnerability, compliance) on all applicable devices within the authorization boundary (e.g., web applications, databases, servers) as stated within the published Department Standards.

5) All required documents have been appropriately developed, approved, updated, and uploaded as an artifact in CSAM, and attached to the appropriate control(s).

6) The information system ISSO must conduct the “Control Level Review” for each implementation statement within CSAM. The Control Level Review will provide a continuous level of assurance of an information system’s security posture. Each control shall be reviewed the quarter prior to its assessment by the SAT in accordance with the defined motives and published OSA schedule.

Table 8: Deliverables for Task 7

Deliverable Due Date Period of Performance

7.1 Security

Categorization and Information Types (FIPS 199)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.2 Digital Identity

Risk Assessment

(DIRA)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.3 Technical

Description

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.4 System

Description

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.5 Configuration

Management Plan

(CMP)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.6 Information

System Contingency Plan

(ISCP)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Deliverable Due Date Period of Performance

Option Period 4

7.7 Contingency Plan

Test Results

(CPT)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.8 Incident Response

Plan (IRP)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.9 Incident Response

Plan Test Results

(IRPT)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.10 Disaster Recovery

Plan (DRP)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.11 Disaster Recovery

Plan Test (DRPT)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.12 Business

Continuity Plan

(BCP)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated

Base Period

Option Period 2

Deliverable Due Date Period of Performance annually or as requested by the COR. Option Period 3

Option Period 4

7.13 Business

Continuity Plan Test (BCPT)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.14 Hardware Listing No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated quarterly or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.15 Software Listing No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated quarterly or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.16 Privacy Threshold

Analysis (PTA)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated bi-annually or as requested by the SAOP.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.17 Privacy Impact

Assessment (PIA), if required

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated bi-annually or as requested by the SAOP.

Base Period

Option Period 1

Option Period 2

Deliverable Due Date Period of Performance

7.18 Memoranda of

Understanding

(MOU),

Interconnection Security Agreements (ISAs), Inter- Agency Agreements (IAA), and Service-Level Agreements (SLAs), if required

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.19 Business Impact

Analysis (BIA)

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.20 SSP Checklist No later than 30 calendar days prior to

planned information system “go live” (not to exceed 90 days after contract award) and then reviewed/updated annually or as requested by the COR.

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

7.21 Vulnerability

Scans

No later than 30 calendar days prior to planned information system “go live” (not to exceed 90 days after contract award) and then as follows for each type of scan:

• Operating system – Weekly

• Web Application – Monthly

• Database – Monthly

• Infrastructure components –

Monthly

• DHS Cyber Hygiene – as conducted by DHS

Base Period

Option Period 1

Option Period 2

7. Key Personnel/Staff Qualifications Offerors should propose key personnel they deem most appropriate to complete the tasks outlined in this requirement. After award, the successful vendor will require the consent of IES to replace the project director (or equivalent).

8. Quality Control and Assurance ED shall evaluate the contractor’s performance accordance with the Quality Assurance Surveillance Plan (QASP; see Attachment B) associated with this procurement. TT

9. Additional ED and Federal-Wide Requirements

9.1 Records and Controlled Unclassified Information (CUI) Requirements

"Federal record" as defined in 44 U.S.C. § 3301, includes all information, made or received by a Federal agency in connection with the transaction of public business. ED owns rights to all records produced as part of this contract. Any Contractor rights must be identified as required by FAR 52.227-11 through FAR 52.227-20.

Federal records must be managed according to the applicable records management laws and regulations, to include the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), 36 CFR Chapter XII Subchapter B, and the Privacy Act of 1974 (5 U.S.C. 552a).

Federal records which are CUI must additionally be managed in accordance with any applicable laws, regulations and government-wide policies (LRGWP) to include EO 13556, 32 CFR Part 2002, ED Directive OCIO 3-113, and NIST-800-171 Revision 2 (or current version).

• Applicability: This clause applies to all Contractors and sub-contractors (hereafter referred to as “Contractors”) and must be incorporated into all subcontracts.

• Training Requirements: All Contractors are required to take the annual Information Management Requirements training. If the contract includes CUI the CUI Identification and Marking Training is required. Additional Category or POC specific trainings may be assigned. Contractor will maintain completion certificates and provide upon request.

• Electronic Information System Requirements: Any electronic information system should address at minimum the following regulations in 36 CFR 1236.10. Agencies must incorporate controls into the system or integrate them into a recordkeeping system that is external to the information system itself (see 36 CFR 1236.20 for recordkeeping system functionalities). Information systems that process, store, or transmit CUI must fulfill the requirements outlined in 32 CFR 2002.14(g).

• Marking Requirements: The Contractor will mark CUI as outlined in Department training.

https://www.archives.gov/about/laws/disposal-of-records.html#def https://www.archives.gov/about/laws/nara.html https://www.archives.gov/about/laws/records-management.html https://www.archives.gov/about/laws/fed-agencies.html https://www.archives.gov/about/laws/disposal-of-records.html https://www.ecfr.gov/cgi-bin/text-idx?SID=28eaaab268f0dd47e9fb9b4f87e9445a&tpl=/ecfrbrowse/Title36/36CXIIsubchapB.tpl https://www.ecfr.gov/cgi-bin/text-idx?SID=28eaaab268f0dd47e9fb9b4f87e9445a&tpl=/ecfrbrowse/Title36/36CXIIsubchapB.tpl https://www.justice.gov/oip/freedom-information-act-5-usc-552 https://obamawhitehouse.archives.gov/the-press-office/2010/11/04/executive-order-13556-controlled-unclassified-information https://www.ecfr.gov/cgi-bin/text-idx?SID=1ff509abab3d3f6b6bde09e078ef3a1a&mc=true&node=pt32.6.2002&rgn=div5 https://www.ecfr.gov/cgi-bin/text-idx?SID=1ff509abab3d3f6b6bde09e078ef3a1a&mc=true&node=pt32.6.2002&rgn=div5 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r2.pdf https://www.ecfr.gov/cgi-bin/text-idx?SID=92e0af0609c96e8970d0a0949b0b2d4c&mc=true&node=se36.3.1236_110&rgn=div8 https://www.ecfr.gov/cgi-bin/text-idx?SID=411edf985a6990e2cffda135ab0c2d65&mc=true&node=se36.3.1236_120&rgn=div8 https://www.ecfr.gov/cgi-bin/text-idx?SID=ef74e93a089b2d1b745122c8b63a4d84&mc=true&node=se32.6.2002_114&rgn=div8

• Handling and Safeguarding Requirements: The Contractor will ensure that CUI is managed appropriately. The requirements include safeguarding, controlled environments, shipping and mailing or transporting protections, and reproduction protections (see 32 CFR 2002.14(a-e)).

• Contract Completion Requirements: Removal or destruction of records must be in accordance with assigned ED records schedule and must include written concurrence from the CO/COR. If records are removed or destroyed the Contractor must report the incident to ED immediately. Destruction or removal of records without the above requirements is subject to fines and penalties imposed by 18 U.S.C. 2701.

• Compliance with Information Protection Requirements: ED reserves the right to verify compliance with information security requirements established by this contract. The Contractor will fully comply with all ED-initiated inspections as permissible by law.

• Information Security Incidents (ISI) Requirements: Contractors must immediately report any and all suspected security incidents, breaches, and events involving ED information to ED’s Computer Incident Response Center (EDCIRC) email: edcirc@ed.gov, and ED’s Security Operations Center (EDSOC) email: edsoc@ed.gov; voice: 202-243-6550, regardless of whether the ISI is suspected, known, or determined to involve IT systems operated i508n support of this contract. In the event of an ISI, ED must be provided immediate access to all IT systems used in support of this contract for inspection and analysis.

9.2 IT Accessibility Requirements (Section 508 of the Rehabilitation Act) Section 508 of the Rehabilitation Act, as amended by P.L. 105-220, requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Products, platforms and services delivered as part of this work statement that are or contain ICT, must conform to the Revised 508 Standards, at 36 C.F.R. § 1194.1 & Apps. A, C & D. https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

• Applicable Functional Performance Criteria: When using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT. – All requirements apply

• Applicable requirements for software features and components: All WCAG Level AA Success Criteria, 502 Interoperability with Assistive Technology, 503 Application – Applies if client server software (installed on a computer) is a part of the procurement.

• Applicable requirements to Webpage and Web Applications: All WCAG Level AA Success Criteria – Applies if websites or a web-based application (browser based) is part of the procurement.

https://www.ecfr.gov/cgi-bin/text-idx?SID=ef74e93a089b2d1b745122c8b63a4d84&mc=true&node=se32.6.2002_114&rgn=div8 https://www.ecfr.gov/cgi-bin/text-idx?SID=ef74e93a089b2d1b745122c8b63a4d84&mc=true&node=se32.6.2002_114&rgn=div8 mailto:edcirc@ed.gov mailto:edsoc@ed.gov https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines#302-functional-performance-criteria https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines#501-general https://www.w3.org/TR/WCAG20/

• Applicable requirements for hardware features and components: Applies if hardware is part of the procurement. (e.g. copiers, fax machines, phones, scanner etc.)

• Applicable support services and documentation: All requirements apply.

• Instructions to Offerors: Provide an Accessibility Conformance Report (ACR) for each commercially available ICT item offered through this contract. Create the ACR using the Voluntary Product Accessibility Template. Complete each ACR in accordance with the instructions provided in the VPAT template. Each ACR must address the applicable Section 508 requirements referenced in the Work Statement. Each ACR shall state exactly how the ICT meets the applicable standards in the remarks/explanation’s column, or through additional narrative.

• Acceptance Criteria: Prior to acceptance, the government reserves the right to perform testing on required ICT items to validate the offeror’s Section 508 conformance claims. If the government determines that Section 508 conformance claims provided by the offeror represent a higher level of conformance than what is actually provided to the agency, the government shall, at its option, require the offeror to remediate the item to align with the offeror’s original Section 508 conformance claims prior to acceptance.

9.3 Security Clearance Requirements

(a) The Contractor and its subcontractors shall comply with Department of Education personnel, cyber, privacy, and security policy requirements set forth in “Contractor Security Vetting Requirements” at http://www.ed.gov/fund/contract/about/bsp.html.

(b) Contractor employees who will have access to proprietary or sensitive Department information including “Controlled Unclassified Information” as defined in 32 CFR 2002.4(h), Department IT systems, Contractor systems operated with Department data or interfacing with Department systems, or Department facilities or space, or perform duties in a school or in a location where children are present, must undergo a personnel security screening and receive a favorable determination and are subject to reinvestigation as described in the “Contractor Vetting Security Requirements.” Compliance with the “Contractor Vetting…