IESE200532BT SOW for IES Cloud Hosting and Web Support.pdf

Statement of Work Version Date: 10/5/2020

Contract Number:TBD

STATEMENT OF WORK

Cloud Hosting, System Administration, and Website Support and Development for the

Institute of Education Sciences

I. BACKGROUND

The Institute of Education Sciences (IES) of the U.S. Department of Education currently maintains a virtual data center hosted in Amazon Web Services (AWS). The virtual data center consists of approximately 60 virtual servers, most of which are a version of Windows Server. The primary function of the data center is to host survey collection and dissemination websites in support of IES’ mission. This includes web servers, database servers, a vast array of websites and data driven web applications, a system management and web development environment, terminal servers housing analytical and statistical software, and other system support servers. Support for all aspects of IES’ web operations, including system administration, website administration and development, and user, staff and developer support, is provided by a team within IES which is comprised of government and contractor staff.

II. SCOPE OF WORK

The objective of this Statement of Work is to acquire the services of a Contractor to provide:

• Access to Amazon Web Services, Infrastructure-as-a-Service (IaaS),

• System support staff

• Website administration and development staff

• System, security, and analytical software.

Contract Type

The contract type for this task order is hybrid, with firm fixed price and cost reimbursement tasks.

Task 1 Cost Reimbursement

Task 2 Firm Fixed Price

Task 3 Firm Fixed Price

Task 4 Cost Reimbursement

III. REQUIREMENTS

Amazon Web Services (AWS)/IaaS Solution

The Contractor shall provide a cost-effective infrastructure hosted in AWS that meets Federal IT security requirements and utilizes industry standards and best practices that meet or exceed the following criteria.

The Contractor shall:

a. Assume AWS account ownership from incumbent contractor, including gaining full control of all

IES owned system resources and accounts hosted in AWS that comprise the IES Data Center.

This is expected to take no longer than 4 weeks.

b. Provide AWS cloud services that are currently utilized in the IES Data Center, as well as providing the ability to expand AWS services as usage demands change over time.

c. Provide access to AWS cloud services that meets or exceeds Federal Information Security

Management Act (FISMA) requirements for information systems categorized as FIPS-199 defined Moderate and complies with the Federal Risk and Authorization Management Process

(FedRAMP) requirements.

d. Provide a solution that shall be physically located in the continental United States, and be in a facility capable of being certified and accredited to host U.S. Government systems.

e. Provide physical colocation space (Equinix SV5, San Jose, CA) to house MTIPS security equipment and cross-connect AWS Direct Connect and MTIPS provider circuits.

f. Provide a robust, fault tolerant infrastructure that allows for high availability of 99.9%, and a one

(1) hour recovery time after failure.

g. Provide technical documentation required for certification and accreditation.

Period of Performance

• Base Year: Mar 1, 2020 – Feb, 28, 2021

• Option Year 1: Mar 1, 2021 – Feb 28, 2022

• Option Year 2: Mar 1, 2022 – Feb 28, 2023

• Option Year 3: Mar 1, 2023 – Feb 29, 2024

• Option Year 4: Mar 1, 2024 – Feb 28, 2025

System Operations Support

The Contractor shall provide system operations support staff, able to perform their work off-site. Support staff shall have experience working with systems in a federal owned data center and demonstrate an understanding through past performance of government IT mandates, regulations, and best practices.

Support staff shall have demonstrated experience with and have strong understanding of privacy and data integrity concerns of federal statistical agencies.

The contractor shall:

a. Transition custody of all IES owned software licensing agreements and AWS accounts including all IES hosting assets from the incumbent.

b. Manage all aspects of the IES virtual data center hosted in Amazon Web Services (AWS), which includes:

• Managing virtual private network, including VPCs, subnets, ACLs, security groups, route tables, IP address allocation, Direct Connect, and DNS.

• Provisioning and maintaining virtual servers, including server resource allocation, storage, and network resources.

• Performing disaster recovery and incident response activities, including server backups and drive snapshots, AWS Cloud Trail monitoring, system redundancy, and monitoring the AWS FedRamp package for FISMA compliance monthly.

• Managing and routinely auditing security and access policies to all AWS resources, including IAM user accounts, groups, and policies, and certificate and key management.

c. Manage all IES servers by providing technical expertise in Microsoft Windows Server, Microsoft

SQL Server, and Microsoft Internet Information Services (IIS). Operations support will manage the production and development infrastructure, restore infrastructure operational capabilities during disaster recovery efforts, and perform daily backups.

d. Perform system maintenance, including system and application patching, McAfee ePO management (anti-virus and HIPS), log management, vulnerability scans and remediation, Active

Directory management, storage maintenance. To minimize impact on users and program activities, it may be necessary to perform some maintenance activities outside of core business hours (7:30 AM – 5:30 PM EST).

e. Manage all IES websites, databases, and support IES web developers. This includes, but not limited to, website troubleshooting, database maintenance, application and file migration, share access, and user account management.

f. Provide staffing that has experience with and have strong understanding of privacy concerns of federal statistical agencies in respect to sensitive data.

g. Act as technical point of contact for IES hosted systems and related issues for IES Government and contractor staff.

h. Provide an annual review of all FISMA documentation, (e.g. System Security Plan, Disaster

Recovery Plan, and Configuration Management Plan)

i. Maintain IES Data Center system information and Plan of Action and Milestones (POA&M) in the Department of Justice Cyber Security Assessment and Management (CSAM) system.

j. Perform annual tests of the Disaster Recovery Plan, Contingency Plan, and Incident Response

Plan.

k. Support the following software and applications:

• Microsoft Windows Server

• Microsoft SQL Server

• Microsoft ASP, ASP.NET, .NET Core

• Linux

• F5 BigIP (LTM, APM, AFM)

• Nagios Log Server

• Microsoft Team Foundation Server

• Microsoft Active Directory

• Microsoft Sharepoint

• AWS Management Console Resources (VPC, EC2, S3, Route 53, Direct

Connect, Cloud Watch, Cloud Front, API Gateway, IAM, and SNS)

• Tenable Nessus

• McAfee ePO

• Apache SOLR

• Solarwinds Serv-U

• PA Server Monitor

• Redgate (SQL Compare, SQL Data Compare, SQL Backup)

• ArcGIS

• Tableau

• Windows Server Update Services (WSUS)

Period of Performance

• Base Year: Mar 1, 2020 – Feb, 28, 2021

• Option Year 1: Mar 1, 2021 – Feb 28, 2022

• Option Year 2: Mar 1, 2022 – Feb 28, 2023

• Option Year 3: Mar 1, 2023 – Feb 29, 2024

• Option Year 4: Mar 1, 2024 – Feb 28, 2025

Website Administration and Development

The Contractor shall provide website administration and development staff, able to perform their work off-site. The contractor shall provide support, administration, and improvements for IES’ dissemination and survey collection websites; ensure that the websites IES hosts comply with standards, agency and federal regulations, and industry best practices; take the lead in developing and maintaining the web development standards that ensure the quality of products disseminated on the websites; consult and advise on technical issues and standards implementation related to the websites; improve website architecture to provide higher quality services; and develop and maintain applications to improve workflow and provide better service to the public and other federal agencies.

The contractor shall:

a. Review all new and existing web content for standards compliance, updating technical standards to align with changing industry standards, federal laws, and agency policies, proving technical support to staff and contractors, answer user submitted questions, publish new content to the website, convert print publications to web format, develop new data dissemination tools as well as update and improve existing tools, and improve overall website architecture and design.

b. Review new and existing content to ensure that the products released on the websites, and the websites themselves, meet federal regulations (including but not limited to Section 508 of the

Rehabilitation Act http://www.access-board.gov/508.htm), industry standards and best practices, and IES style and technical standards. In addition to meeting standards, the contractor shall test new web applications for performance, usability, and functionality.

c. Continually monitor the request system for new submissions, review new requests to ensure they are correctly formatted and categorized, and establish priority of each request based on time of release or severity if the request is to correct an issue on a live website.

d. Provide technical support to staff and contracts on all matters related to the IES websites, including providing assistance with meeting standards, developing templates and tutorials related to web publishing, answering technical questions about website and server infrastructure and system limitations, providing web analytics support, and assisting the server operations team with application issues and technical guidance.

e. Respond to user questions related to the websites in a timely manner or refer questions to appropriate IES staff members based on subject matter of the question and the area or expertise of the staff.

f. Continually update IES’ web development standards with new specifications and remove obsolete standards to be current and align with industry, agency and federal standards.

g. Convert publications specifically selected by IES staff into a suitable web format. Some of the publications include, but are not limited to, Condition of Education

(http://nces.ed.gov/programs/coe/), Digest of Education Statistics

(http://nces.ed.gov/programs/digest/), and Projections of Education Statistics

(http://nces.ed.gov/programs/projections/). This process entails creating html and image files that meet NCES standards, converting tables into accessible html tables, creating navigation based off of publication table of contents, and creating and optimizing graphics.

h. Continually update IES’ websites with content provided by IES staff to ensure that the websites stay current with the latest information. Examples of updated content includes, but is not limited to: updating and adding new conferences and trainings, updating the publication release calendar, posting new What’s New, Highlights, and Data Snapshots items to the homepage, adding and removing IES staff listings, publishing new Stat Chats, posting Commissioner’s Remarks and press releases, processing publication requests, and updating site navigation and site map. The contractor shall also send “Newsflash” emails upon request, which occur on average 5 times a week. The Newsflash content and designated audience will be provided by IES staff.

i. Update the content on the various survey and program area sections and create new survey and program areas sections as needed.

j. Monitor user search patterns and create new keywords, key matches, and filters to return better search results and help users find website content.

k. Publish new content provided by NCES and other Forum participants to the Childstats.gov website, including updating and creating new HTML and image files.

l. Maintain and update websites for IES (http://ies.ed.gov) This work includes, but is not limited to, posting new publications and content to IES websites, adding new grants/funding information, updating the grants database with detailed grants and grant program descriptions, principal investigators, and other details, posting webinars, and publishing the IES bi-monthly newsletter.

The Regional Educational Laboratory Program (REL) website (http://ies.ed.gov/ncee/edlabs/) has additional needs including adding new publications and projects to the REL project database and maintaining the information on the various labs.

m. Update dissemination tools to use the most recently available data and improve those search tools by adding new features requested by NCES program staff. The tools to be updated include, but are not limited to: College Navigator (http://nces.ed.gov/collegenavigator/), and Search for

Schools and Colleges (http://nces.ed.gov/globallocator/).

n. Manage and update the ERIC.ED.GOV website, including importing new records, adding application features and new data fields, and maintaining data import tools.

o. Update and improve existing tools on the IES Members Site such as the request management system, web publication system, calendar and conference tools, Newsflash system, and create new website management and workflow improvement tools as needed.

p. Maintain the Review Tracking System (RTS) application on the IES intranet site to improve the performance and to facilitate electronic publication tracking of IES publications and data products, as directed by the RTS task leader.

q. Update and improve the common website framework that allows for a standard look and menu elements, and ease development and management, including adding new features, regularly updating graphical elements and styles, and improving standards compliance and performance.

r. Provide all deliverables in electronic formats and provide all computer programming source files and code used in the creation of deliverables.

• Base Year: Nov 1, 2020 – Feb, 28, 2021

• Option Year 1: Mar 1, 2021 – Feb 28, 2022

• Option Year 2: Mar 1, 2022 – Feb 28, 2023

• Option Year 3: Mar 1, 2023 – Feb 29, 2024

• Option Year 4: Mar 1, 2024 – Feb 28, 2024 http://ies.ed.gov/ http://nces.ed.gov/globallocator/

Software Licenses

The Contractor shall provide system and software licenses allowing for additional functionality in support of IES’ cloud hosted systems. The software and software licensing to be purchased through this task order are as follows:

Product QTY

BIG-IP Virtual Edition Best Bundle (v. 12.1.x - 18.x) - license - 1 Gbps 2

PA Server Monitor Pro 1 Year Support 1

Shutterstock subscription renewal (1 year subscription) 1

Stat/Transfer 25 User Site License - Academic (annual lease) 1

McAfee Associate MFE Endpoint Protection 1YR GL P+ 51-100U (EPSYFM-AA-CA) 75

Stata/MP4 network maintenance for 501306217520; 7−user network license 1

Serv-U MFT 1 year upgrade protection 1

SAS Analytics Pro for a Virtual Machine with 4 processor cores, Windows 64 bit. Annual Maintenance for Site 671625. (SAS-CORES-APRO-4M) 1

SAS/ETS & SAS/IML for a Virtual Machine with 4 processor cores, Windows 64 bit. Annual Maintenance for Site 671625. (SAS-CORES-OTHER-4M) 2

SAS/Access to ODBC & SAS/Access to PCFF for a Virtual Machine with 4 processor cores, Windows 64 bit. Annual Maintenance for Site 671625. (SAS-CORES-ACCESS-4M) 2

FileUp Standard Edition - Annual Maintenance 1

SUDAAN Release 11.0.1 - Annual License 1

NESSUS PROFESSIONAL ONPREM-ANNUAL SUB (RENEW) LICSEU#-003360824, INSTITUTE

OF EDUCATIO, SERV-NES-R 1

IBM SPSS AMOS CONCURRENT USER ANNUAL SW SUBSCRIPTION & SUPPORT RENEWAL

(E09QRLL)

IBM SPSS ADVANCED STATISTICS CONCURRENT USER ANNUAL SW SUBSCRIPTION &

SUPPORT RENEWAL (E09PULL)

IBM SPSS STATISTICS BASE CONCURRENT USER ANNUAL SW SUBSCRIPTION & SUPPORT

RENEWAL (E09PWLL)

IBM SPSS COMPLEX SAMPLES CONCURRENT USER ANNUAL SW SUBSCRIPTION & SUPPORT

RENEWAL (E09PNLL)

IBM SPSS CUSTOM TABLES CONCURRENT USER ANNUAL SW SUBSCRIPTION & SUPPORT

RENEWAL (E09PYLL)

IBM SPSS MISSING VALUES CONCURRENT USER ANNUAL SW SUBSCRIPTION & SUPPORT

RENEWAL (E09Q3LL)

IBM SPSS REGRESSION CONCURRENT USER ANNUAL SW SUBSCRIPTION & SUPPORT

RENEWAL (E09PJLL)

Microsoft Azure DevOps Server - license & software assurance – Server (125-00214) 1

Microsoft Azure DevOps Server - license & software assurance – User CAL (126-00371) 10

Nagios Log Server – 2 server instances 1

• Base Year: Mar 1, 2020 – Feb, 28, 2021

• Option Year 1: Mar 1, 2021 – Feb 28, 2022

• Option Year 2: Mar 1, 2022 – Feb 28, 2023

• Option Year 3: Mar 1, 2023 – Feb 29, 2024

• Option Year 4: Mar 1, 2024 – Feb 28, 2025

IV. SCHEDULE DELIVERABLES

Activity Deliverable Estimated Due Date

Base Year

Task 1 Availability of Base Virtualized Hosting

Environment

Within two weeks from award date

Task 2 Support personnel assigned to support systems

Within two weeks from award date

Task 3 Website staff assigned to support website Within two weeks from start of period of performance

Task 4 System license or software Within two weeks of request for license

V. INVOICING

The contractor shall submit monthly reports on or before the 10th of each month. The monthly reports are to be submitted via lectronic transmission. The monthly report shall be submitted to the COR, appointed Task Leader, and Contract Specialist.

The report shall include the following:

a) The progress on each task and activity relative to the schedule and a discussion of discrepancies;

b) Accomplishments associated with each task and activity for the month;

c) Problems that have been resolved or are in need of resolution;

d) A discussion of the work to be performed during the next monthly reporting period;

e) Brief description of the work performed by each subcontractor during the month;

f) Detailed breakdown of cloud hosting spending;

g) Funding expended by major category, including staff, travel, consultant, subcontractors, and other costs, including obligated costs of subcontractors; and

h) Expected future technical and budgetary problems and proposed solutions to these.

VI. CONFIDENTIALITY, SECURITY, IT & OTHER REQUIREMENTS

Staffing

The contractor shall provide in writing at least two (2) weeks advanced notice for replacement of staff proposed. This notice shall be provided to the Task Leader, COR and Contracting Officer (CO) and shall include justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on the program. All resumes of proposed replacement staff must be provided and approved by the

COR and Task Leader before replacing any individual on this project.

Security Clearance

The work to be performed on this contract has been classified at the OPM risk level of “High Risk.

Potential for exceptionally serious impact to the public’s trust; position duties and responsibilities are especially critical to the agency or a program mission.” The contractor shall provide staff capable of achieving a 6c Public Trust Clearance.

Confidentiality of Individuals and Institutions

IES assures participating individuals and institutions that any data collected conforms to the IES standards for protecting the privacy of individuals as required by Section 183 of the Education Sciences

Reform Act of 2002 (P.L. 107-279):

“. . . all collection, maintenance, use, and wide dissemination of data by the Institute, including each office, board, committee, and Center of the Institute, shall conform with the requirements of section

552A of Title 5, United States Code [which protects the confidentiality rights of individual respondents with regard to the data collected, reported, and published under this title].” (Section 183)

Under the Education Sciences Reform Act of 2002 (ESRA 2002), all individually identifiable information about students, their families, and their schools shall remain confidential. To this end, this law requires that no person may:

• Use any individually identifiable information furnished under the provisions of this section for any purpose other than statistical purposes for which it is supplied, except in the case of terrorism;

• Make any publication whereby the data furnished by any particular person under this section can be identified; or

• Permit anyone other than the individuals authorized by the Commissioner to examine individual reports.

Further, individually identifiable information is immune from legal process, and shall not, without the consent of the individual concerned, be admitted as evidence or used for any purpose in any action, suit, or other judicial or administrative proceeding, except in the case of terrorism. Employees, including temporary employees, or other persons who have sworn to observe the limitations imposed by this law, who knowingly publish or communicate any individually identifiable information will be subject to fines of up to $250,000 or up to 5 years in prison, or both (Class E felony).

Protection and Security of Data

The confidentiality of individually identifiable information contained in project documents, data, and other information supplied by the Institute of Education Sciences, U.S. Department of Education (the

Department) or information acquired in the course of performance under this contract where the information was furnished under the provisions of Section 183 of the Education Sciences Reform Act of

2002 is a material aspect of the contract and must be maintained, secured, and protected from disclosure as provided in Section 183. The Privacy Act of 1974 (5 U.S.C. 552a) also applies.

The contractor shall enforce strict procedures for assuring confidentiality. These procedures shall apply to all phases of the project and should include but not be limited to: information used to locate study respondents, data collection in the field, coding and editing phases of data prior to machine processing, safeguarding response documents, and maintenance of any respondent follow-up information. Contractor shall physically separate the identifying data required for any follow-up from data required for research purposes.

The contractor shall be familiar with and comply with:

1) The Privacy Act of 1974 (5 U.S.C. 552a), https://www.justice.gov/opcl/privacy-act-1974

2) Confidentiality Information Protection and Statistical Efficiency Act (CIPSEA) of 2002

(P.L. 107-347, Title V, Subtitle A, “Confidential Information Protection”), http://www.gpo.gov/fdsys/pkg/STATUTE-116/pdf/STATUTE-116-Pg2899.pdf

3) Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. 1232g; 34 CFR Part

99), https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html

4) The Freedom of Information Act (5 U.S.C. 552), https://www.foia.gov/ n

5) Part C of the Education Sciences Reform Act of 2002 (P.L. 107-279), https://www.congress.gov/107/plaws/publ279/PLAW-107publ279.pdf,

6) Part E, Section 183 of the Education Sciences Reform Act of 2002 (P.L. 107-279), https://www2.ed.gov/policy/rschstat/leg/PL107-279.pdf,

7) No Child Left Behind Act (20 U.S.C. 70), https://www2.ed.gov/policy/elsec/leg/esea02/index.html,

8) USA Patriot Act of 2001 (P.L. 107-56), https://www.congress.gov/bill/107th-congress/house-bill/3162,

9) Office of Management and Budget (OMB) Federal Statistical Confidentiality Order of

1997, https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/federal_register/FR1997/co nf-order.pdf, https://www.justice.gov/opcl/privacy-act-1974 http://www.gpo.gov/fdsys/pkg/STATUTE-116/pdf/STATUTE-116-Pg2899.pdf https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html https://www.foia.gov/ https://www.congress.gov/107/plaws/publ279/PLAW-107publ279.pdf https://www2.ed.gov/policy/rschstat/leg/PL107-279.pdf https://www2.ed.gov/policy/elsec/leg/esea02/index.html https://www.congress.gov/bill/107th-congress/house-bill/3162 https://www.congress.gov/bill/107th-congress/house-bill/3162 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/federal_register/FR1997/conf-order.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/federal_register/FR1997/conf-order.pdf

10) OMB Guidance of 7/12/2006 on the Reporting of Incidents Involving Personally

Identifiable Information (M-06-19), http://www.whitehouse.gov/OMB/memoranda/fy2006/mo6-19.pdf,

11) OMB Guidance of 5/22/2006 on Safeguarding Personally Identifiable Information (M-

06-15), http://www/whitehouse.gov/omb/memoranda/fy2006/m-06-15.pdf,

12) Federal Information Security Management Act (FISMA) of 2002 (P.L. 107-347, Title

III),

The contractor shall maintain the confidentiality of all documents, data, and other information supplied by

IES/ED or acquired in the course of performance of this contract, except for any documents or other information specifically designated as non-confidential by IES/ED. The contractor shall take such measures as are necessary to maintain the required security and protection of confidential information

(see section Data Security Plan). The contractor shall be prepared to develop compliance procedures in cooperation with the COR concurrently with the development of the study design.

IT Security and Policies

The contractor shall:

• Complete/update the appropriate level of Security Accreditation (SA) documentation per NIST

Risk Management Framework guidance, security controls testing, interagency security agreements (ISAs), and risk assessments in support of government issuance of security assessment and authorization to operate (ATO) decisions

• Ensure that systems/products/applications have the ability to facilitate single-sign-on capabilities and required support for HSPD 12 Personal Identity Verification (PIV) enablement and integration

• Include the capability for network traffic that flows between externally hosted systems and networks, to/from Department systems and networks, to be routed through one of the

Department’s Trusted Internet Connections (TIC) gateways as part of the solution configuration.

Implement controls to ensuring all possible traffic, including mobile and cloud, goes through a

TIC. Implement connections between Department systems and networks with externally hosted systems that are in compliance with the requirements of the Trusted Internet Connections (TIC) initiative

• Architect contractor hosting environments to use security isolation and network segmentation principles in order to ensure that the environments are properly protected against an unauthorized access and threat from adversaries who may strive to move laterally across internal Department or contractor hosted systems and network segments.

• Provide an automated capability and process to scan and assess all systems and assets, and associated logs for malicious indicators of compromise (IOCs) identified by the Department regarding priority threat-actor Techniques, Tactics, and Procedures (TTPs); the contractor is required to have the capability to scan for indicators of compromise within 24 hours of receipt of the indicators provided by the Department of Education from the Department of Homeland

Security http://www.whitehouse.gov/OMB/memoranda/fy2006/mo6-19.pdf http://www/whitehouse.gov/omb/memoranda/fy2006/m-06-15.pdf

• Implement and maintain capabilities and processes to support the timely detection of, reporting, and rapid response and recovery to cyber incidents in accordance with timelines and requirements specified in Federal guidance and Department cybersecurity incident reporting policy guidance

• In support of cybersecurity performance measure reporting, the contractor shall implement and maintain an automated software asset management/inventory and hardware asset inventory capability (e.g. scans/device discovery processes) at the enterprise-level.

• Implement capabilities to rapidly deploy emergency security patches and implement specific security control enhancements as directed by the Department of Homeland Security to all Federal

Departments via mechanisms such as the DHS Cybersecurity Coordination, Assessment, and

Response (C-CAR) action items, and DHS Binding Operational Directives (BODs).

• Implement capabilities and processes to patch all critical vulnerabilities identified to the

Department of Education by DHS immediately or, at a minimum, within 30 days of patch release.

• Ensure robust physical and cybersecurity protections are in place for all of the Department’s high value assets (HVAs). The identification of HVAs by the Department will be an ongoing activity due to the dynamic nature of cybersecurity risks.

• Implement remote access solutions that only use multi-factor authentication solutions and that prohibit the use of split tunneling and/or dual-connected remote hosts where the connecting device has two active connections.

• Implement remote access solutions that scan for malware before allowing full connections and that time out after 30 minutes (or less) of inactivity and require re-authentication to re-establish a session

• Implement capabilities for all incoming email traffic to pass through anti-phishing and anti-spam filtration at the outermost border mail agent or server

• Implement capabilities for all incoming email traffic to be analyzed using sender authentication protocols (e.g., DKIM, DMARC, VBR, SPF, iprev)

• Implement capabilities that ensure that incoming email traffic is analyzed using a reputation filter

(to perform threat assessment of sender)

• Implement capabilities that ensure that incoming email traffic is analyzed for detection of clickable URLs, embedded content, and attachments; and incoming email traffic is first analyzed for suspicious or potentially nefarious attachments and opened in a sandboxed environment or detonation chamber

• Implement capabilities for all outbound communications traffic to be checked at the external boundaries to detect encrypted exfiltration of information (i.e. capability to decrypt/interrogate and re-encrypt)

• Implement effective network segmentation design and security solutions to limit potential threats from adversaries attempting lateral movement across systems on the Department’s (or contractor’s networks), and also to better protect and securely isolate the Department’s HVAs

• Implement and maintain Information Security Continuous Monitoring (ISCM) and Continuous

Diagnostics and Mitigation (CDM) capabilities for all IT assets to be subject to an automated inventory, configuration, and vulnerability management capability, with real time reporting

• Implement and maintain strong authentication capabilities requiring the technical enforcement of all users being required to use a Personal Identity Verification (PIV) card to authenticate to the network, (with exceptions for a very limited set of users specifically approved by the Department)

• Develop and maintain (or update existing) System Security Plans (SSP) and security controls assessment (SCA) test plans for the network general support system (GSS), and infrastructure systems

• Provide support to creating the security assessment and authorization (or accreditation) (SA&A) packages and documentation in accordance with the Risk Management Framework guidance and processes specified by NIST and Department guidance

• Implement security configurations on all IT assets and systems using DISA STIGs and other industry recognized best practices or guidance

• Perform security configuration management to include configuring all Windows based systems with the latest United States Government Configuration Baseline (USGCB) security settings available from the NIST website

• Support annual or emergent security audits and security scans that may be performed by the

Office of Inspector General (OIG), the General Accountability Office (GAO), or the Department of Homeland Security (DHS)

• The contractor shall provide availability and accessibility to the Department, to the OIG, and to any third party vendors designated by the Department to: 1) Review audit findings; 2) Determine if corrective actions were properly implemented and the associated audit findings were properly closed; 3) Support cybersecurity incident analysis and forensics activities

• Produce scheduled Monthly/Quarterly/Annual security performance measure reports that align to the Department’s cybersecurity performance measure reporting requirements specified by OMB for FISMA, the President’s cybersecurity Cross Agency Priority (CAP) goals and targets, and

CyberScope reporting. Security performance measure reports shall use the format and template specified in the Annual CIO FISMA metrics specified by OMB and DHS.

• Provide for the encryption for PII, CUI, Data at Rest and data in transit, Encryption solutions applied must be FIPS 140-2 validated.

• Document and track contractor personnel cyber training based on roles

• Develop, maintain, and publish a listing of Contractor-provided security controls, hybrid security controls, and “customer”-provided security controls, in support of systems security assessments and authorizations, and the issuance of authority to operate (ATO) decisions by the Department

• Provide security audit support (e.g. A-123), including scheduled and event-driven audits

• Capture and provide forensic disk images to support security incident analysis, malware analysis, or other investigative requirements (such as specific requests from the OIG or law enforcement)

• Provide support for threat monitoring and analysis, incident response, vulnerability management, risk management, continuous monitoring and reporting and other traditional security operations center activities

• Provide and maintain multi-factor authentication solutions utilizing the Personal Identity

Verification (PIV) card (or a Department- approved Level of Authentication -4 solution); and utilize FIPS 140-2 approved encryption for all remote access requirements

• Provide robust encryption capabilities to include services such as digitally signed and encrypted email, and default encryption for sensitive information held by the Department. Solutions should be available to enable encryption of as much data at rest and data in transit as possible.

• Identify, perform, track, and report vulnerability and security weakness remediation and mitigation activities through the Department’s Plan of Action and Milestones process (POA&M) in accordance with Departmental information security policy

• Establish, maintain, and execute standard configuration management processes for all cybersecurity software and hardware

• Implement and maintain a Privileged Account Management Solution to improve the identity and access management of user accounts, while also meeting Department targets to tightly control and limit the number of users with elevated privileges

• Implement and maintain tightened processes for managing privileged user accounts, to include implementation of capabilities to limit functions that can be performed when using privileged accounts; limit the duration that privileged users can be logged in; limit the privileged functions that can be performed using remote access; prohibit Internet access when privileged users are performing systems administrations tasks; and ensure that privileged user activities are logged and regularly reviewed

• Document and maintain system security boundaries, system configuration details, and network diagrams, in support of security assessment and authorization to operate (ATO) processes

• Develop and implement processes for revising system security documentation on a scheduled and event-driven basis

• Provide support for maintaining system security documentation in support of FISMA reporting requirements and security compliance status in the Department’s Cyber Security Assessment and

Management (CSAM) system

• Develop and submit system security documentation, risk assessments, security controls testing reports, and any required privacy impact analysis (PIA) to the Department in support of the Risk

Management Framework processes and ATO decisions for IT environment components

• Develop corrective/remediation plans of action and milestones (POAMs) and strategies to address security audit and assessment findings, and other reports of system security weaknesses or non-compliance

• Develop and maintain a system security architecture; the contractor’s solution shall include effective network segmentation design and solutions to limit lateral movement across systems on the Department’s networks, and also better protect the Department’s HVAs

• Utilize PIV or other approved Level of Assurance 4, as defined in NIST SP 800-63-2 Electronic

Authentication Guidelines, compliant Identity and Access Control mechanisms for network/domain administrative enterprise access.

• Maintain near real-time security monitoring and intrusion detection capabilities to enable the contractor and the Department to know the security risk posture of the network at any given time;

• Configure all Windows based systems with the latest United States Government Configuration

Baseline (USGCB) security settings available from the NIST website

• Utilize multi-factor authentication, including integration and compliance with HSPD-12 PIV requirements, for all remote access solutions for the Department’s sensitive information systems

• Provide a multi-tier disaster recovery capability that provides the infrastructure and process to meet the recovery requirements of all of its High Value Assets (HVAs), and applications

(Mission-Critical, Decision Support, Other)

• Provide IT Disaster Recovery Planning and Management capabilities and support o Define business risk and risk assessment o Develop disaster recovery strategies o Develop disaster recovery plans o Develop IT system contingency plans o Conduct disaster recovery exercises, training and awareness

• Provide Disaster Recovery Operational Services, including Contractor support to the Department in the planning, preparation, implementation, and documentation of a Disaster Recovery Program that includes the capabilities described below:

The contractor, and all sub-contractors, shall comply with the Department of Education’s IT security policy requirements, and other applicable procedures and guidance. The contractor, and all sub-contractors, shall develop and implement management, operational and technical security controls to assure required levels of protection for information systems. The contractor, and all sub-contractors, shall further comply with all applicable Federal IT security requirements including, but not limited to, the

Federal Information Security Modernization Act (FISMA) of 2014, Office of Management and Budget

(OMB) Circular A-130, Homeland Security Presidential Directives (HSPD), including HSPD-12, Personal Identity Verification (PIV) Enablement and Integration, and single sign-on, the most recent

National Institute of Standards and Technology (NIST) special publications, standards and guidance, and the Federal Risk and Authorization Management Program (FedRAMP) requirements and guidance.

These security requirements include, but are not limited to, the successful Security Assessment and

Authorization (SA&A) of the system (includes commercially owned and operated systems managed by the commercial vendor and its sub-contractors, supporting Department programs, contracts, and projects);

obtaining a full Authority to Operate (ATO) before being granted operational status; performance of annual self-assessments of security controls; annual Contingency Plan testing; performance of periodic vulnerability scans; updating all information system security documentation as changes occur; and other continuous monitoring activities, which may include, mapping, penetration and other intrusive scanning.

Full and unfettered access for any of the Department’s third party Managed Security Services Provider

(MSSP) or Cyber-operations prevention testers, or vulnerability scanners, or auditors must be granted to access all computers and networks used for this system. Additionally, when there is a significant change to the system’s security posture, the system (Federal and commercial prime- and sub- contractors included) must have a new SA&A, with all required activities to obtain a new ATO, signed by the

Authorizing Official (AO).

System security controls shall be designed and implemented consistent with the current, finalized version of the NIST SP 800-53, ‘Recommended Security Controls for Federal Information Systems and

Organizations.’ All NIST SP 800-53 controls must be tested / assessed no less than every 3 years, according to federal and Department policy. The risk impact level of the system will be determined via the completion of the Department's inventory form and shall meet the accurate depiction of security categorization as outlined in Federal Information Publishing Standards (FIPS) 199, ‘Standards for

Security Categorization of Federal Information and Information Systems.’

System security documentation shall be developed to record and support the implementation of the security controls for the system. This documentation shall be maintained for the life of the system. The contractor, and all sub-contractors, shall review and update the system security documentation at least annually and after significant changes to the system, to ensure the relevance and accurate depiction of the implemented system controls and to reflect changes to the system and its environment of operation.

Security documentation must be developed in accordance with the NIST 800 series and Department of

Education policy and guidance.

The contractor, and all sub-contractors, shall allow Department employees (or Department designated third party contractors) access to the hosting facility to conduct SA&A activities to include control reviews in accordance with the current, finalized version of the NIST SP 800-53, and the current, finalized version of the NIST SP 800-53A. The contractor, and all sub-contractors, shall be available for interviews and demonstrations of security control compliance to support the SA process and continuous monitoring of system security. In addition, if the system is rated as ‘Moderate’ or ‘High’ for FIPS 199 risk impact, vulnerability scanning and penetration testing shall be performed on the hosting facility and application as part of the SA&A process. Appropriate access agreements will be reviewed and signed before any scanning or testing occurs.

Identified deficiencies between required security controls within the current, finalized version of the NIST

SP 800-53 and the contractor’s, and all sub-contractor’s implementation, as documented in the Risk

Assessment Report, System Security Plan (SSP) and Security Assessment Report (SAR), shall be tracked for mitigation through the development of a Plan of Action and Milestones (POA&M) in accordance with

Department policy. Depending on the severity of the deficiencies, the Department may require remediation before an ATO is issued.

The contactor shall provide cybersecurity strategies, infrastructure hosting environments, and solutions that comply with the requirements of the Federal Information Security Modernization Act (FISMA), Department cybersecurity policy guidance, and guidance contained in the NIST Special Publications series such as NIST Special Publication 800-53 and other NIST Special Publications. The contractor shall provide solutions that support the Department’s efforts to implement and maintain effective protection activities such as reducing the attack surface and complexity of IT infrastructure; minimizing the use of administrative privileges; utilizing strong authentication credentials; safeguarding data at rest and in-transit; training personnel; ensuring repeatable processes and procedures; adopting innovative and modern technology; ensuring strict domain separation of critical/sensitive information and information systems; implementing network segmentation architectures to better protect and isolate the Department’s high value assets and most sensitive information and data; and ensuring a current inventory of hardware and software components. The contractor shall include actions and initiatives to implement the NIST

Cybersecurity Framework that emphasizes and measures capabilities to “Identify, Protect, Detect, Respond, and Recover,” and ensure that all applicable Service Level Agreements (SLA)s are adhered to, complied with, and satisfied.

All awarded contracts shall ensure that:

1. Their IT product/system is monitored during all hours of operations using entrusted detective/preventive systems;

2. Their IT product/system has current antiviral products installed and operational;

3. Their IT product/system is scanned on a reoccurring basis;

4. Vulnerabilities are remediated in a timely manner on their IT product/system; and

5. Access/view for cyber security situational awareness on their IT product/system is made available to the Department CIRC (cyber incident response capability).

6. All applicable Service Level Agreements (SLA)s are adhered to, complied with, and satisfied.

Internet Protocol version 6 (IPv6)

For IPv6, the contractor shall provide COTS solutions that are IPv6 capable. An IPv6 capable system or product shall be capable of receiving, processing, transmitting and forwarding IPv6 packets and/or interfacing with other systems and protocols in a manner similar to that of IPv4. Specific criteria to be deemed IPv6 capable are:

• An IPv6 capable system that meets the IPv6 base requirements defined by the USGv6 Profile

(http://www.antd.nist.gov/usgv6/profile.html).

• Systems being developed, procured or acquired shall maintain interoperability with IPv4 systems/capabilities.

• Systems shall implement IPv4/IPv6 dual-stack and shall also be built to determine which protocol layer to use depending on the destination host it is attempting to communicate with or establish a socket with. If either protocol is possible, systems shall employ IPv6.

• The contractor shall provide IPv6 technical support for system development, implementation and management.

Per OMB-M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, the following requirements statements should be added to all

SOWs/SOOs/PWSs/BPAs/MOUs/IAAs/MOUs/ISAs that include the management of Personally

Identifiable Information (PII) and / or Sensitive Personally Identifiable Information (SPII):

http://www.antd.nist.gov/usgv6/profile.html

• The contractor shall cooperate with and exchange information with agency officials, as determined necessary by the agency, in order to effectively report and manage a suspected or confirmed breach.

• The contractor and subcontractors (at any tier) shall properly encrypt PII in accordance with

OMB Circular A-130 and other applicable policies and to comply with any agency-specific policies for protecting PII;

• The contractor shall complete regular Department training for contractors and subcontractors (at any tier) on how to identify and report a breach;

• The contractor and subcontractors (at any tier) shall report a suspected or confirmed breach in any medium or form, including paper, oral, and electronic, as soon as possible and without unreasonable delay, consistent with the agency's incident management policy and US-CERT notification guidelines;

• The contractor and subcontractors (at any tier) shall maintain capabilities to determine what

Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access Federal information, and identify the initial attack vector;

• The contractor shall allow for an inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with this Federal and Department PII Breach Response policies

(such as OMB-M-17-12), the Department’s breach response plan, and to assist with responding to a breach;

• The contractor shall identify roles and responsibilities, in accordance with Federal and

Department PII Breach Response policies (such as OMB-M-17-12), and the agency's breach response plan; and,

• The contractor shall be aware that a report of a breach shall not, by itself, be interpreted as evidence that the contractor or its subcontractor (at any tier) failed to provide adequate safeguards for PII.

Reporting of Data Security Breaches

If there is a suspected or known breach/disclosure of PII due to lost, theft, intercepted transfer, or other, the contractor must ensure that this breach is reported to the agency as soon as the contractor has knowledge of it. Per Office of Management and Budget Memorandum M-17-12, Federal agencies have a requirement to report breaches of PII security to the United States Computer Emergency Response Team

(US-CERT).” The (PO) must notify the department within 30 minutes of discovering the incident (and the agency should not distinguish between suspected or confirmed breaches). The data security plan must be written to reflect this requirement, and the contractor must provide sufficient notification and documentation of the suspected loss, as it is understood at the time of notification to the agency for this requirement to be met. Follow-up reports of the final status of loss events will also be prepared by the contractor within a reasonable period of time as advised by the COR.

FOR E-MAIL:

In accord with BOD-18-01:

• Email Security: Agencies must configure all internet-facing mail servers to offer STARTTLS, and all second-level agency domains to have valid SPF/DMARC records. Additionally, agencies must ensure Secure Sockets Layer (SSL) v2 and SSLv3 are disabled on mail servers, and 3DES and RC4 ciphers are disabled on mail servers:

o Within one year after issuance of this directive, issued 10-16-2017 (so, due by 10-16-

2018), agencies will be required to set a DMARC policy of “reject” for all second-level domains and mail-sending hosts.

o In accord with OMB Memorandums M-17-06, and M-15-13, and M-08-23, M-10-23, and with Binding Operational Directive (BOD) BOD-18-01, and with the NIST SP 800-52 and with the NIST SP 800-44, all e-mail applications must have SMTP enabled.

FOR NON-PUBLIC-FACING WEBSITES:

• Implement capabilities for all inbound network traffic to pass through a web content filter, which provides anti-phishing, anti-malware, and blocking of malicious websites (e.g., fake software updates, fake antivirus offers, and phishing offers)

•…