LMS RFI Bureau of Prisons.pdf

FBOP

Learning Management System RFI for FBOP

6-24-2025

TABLE OF CONTENTS

1.0 Background

2.0 Purpose & Scope

3.0 Requirements

3.1 Hardware

3.2 Storage

3.3 FedRAMP Compliance

3.4 Privacy Act and FOIA Requirements

3.5 System Standards Compliance

4.0 Assumed Milestone/Phases for initiative

5.0 IT Requirements

5.1 APPLICABILITY

5.2 OPERATING SYSTEMS, DATABASES, AND APPLICATIONS

5.3 SECURITY ASSESSMENT AND AUTHORIZATION COMPLIANCE

5.4 PRIVACY AND RECORDS MANAGEMENT

5.5 SYSTEM INTERCONNECTIONS

6.0 Request for Information Response

6.1 Company Overview

6.2 LMS Product Overview

6.3 Technical Capabilities and Requirements Alignment

6.4 Implementation Strategy

6.5 Security and Privacy Compliance

6.6 Pricing Information

6.7 Past Performance

6.8 Questions or Concerns

6.9 Attachments (Optional)

7.0 Disclaimer

8.0 Questions & Answers

1.0 Background

The FBOP is responsible for the custody and care of approximately 156,000 Federal offenders.

Approximately 91 percent of these inmates are confined in Bureau-operated facilities, while the balance is confined in community-based facilities. More information about the agency can be found on the Federal Bureau of Prisons’ public site, www.bop.gov.

2.0 Purpose & Scope

The Federal Bureau of Prisons (FBOP), a component of the U.S. Department of Justice, is conducting market research through this Request for Information (RFI) to identify capable vendors who can provide a secure, cloud-based, commercial-off-the-shelf (COTS) Learning Management System (LMS). The purpose of this system shall be to support and modernize the Bureau’s inmate education programs, reentry preparation efforts, and staff training and development functions.

FBOP is seeking to implement a scalable, configurable LMS solution that shall improve access to educational content, standardize instructional delivery, streamline administrative processes, and enhance data tracking and reporting across more than 120 correctional institutions nationwide. The system shall be robust, intuitive, and capable of operating in a complex federal environment with stringent security and compliance requirements.

Key elements within the scope of this initiative include:

• Provision and configuration of a COTS-based LMS that shall be FedRAMP Authorized at a minimum of the Moderate Impact Level.

• Support for multiple user groups, including inmates, staff instructors, administrators, and supervisors with appropriate role-based access controls.

• Ability to host and deliver academic courses, vocational training, reentry content, and staff development curriculum.

• Integration with FBOP’s existing identity management, HR, and educational systems.

• Support for both online and offline learning modes to accommodate connectivity limitations at secure correctional facilities.

• Tools for course creation, content import, assignment tracking, and learner assessments.

• Compliance with federal IT security standards, including Section 508 accessibility, FIPS

140-2 encryption, and CJIS compatibility where applicable.

The LMS shall play a critical role in:

• Advancing inmate rehabilitation by ensuring equitable and continuous access to educational resources regardless of location or transfer.

• Enabling individualized learning paths and career development.

• Enhancing operational efficiency for instructors and administrative staff through centralized management tools.

• Providing detailed analytics and reports to inform decision-making and ensure program effectiveness.

The Bureau is specifically interested in vendor solutions that offer modular features, flexible licensing options, and a comprehensive implementation strategy including data migration, user training, and ongoing technical support.

3.0 Requirements

The following section outlines the key technical, security, and compliance requirements for any proposed Learning Management System (LMS) solution intended for deployment within the Federal Bureau of Prisons (FBOP). Solutions that do not meet these baseline criteria may be deemed unsuitable for further consideration.

3.1 Hardware

The LMS shall be hosted in a cloud-based environment with no hardware to be maintained on-site by FBOP. The solution shall operate in a commercial cloud service environment that meets FedRAMP Moderate Impact Level authorization. The environment shall ensure high availability and geographically redundant backup and disaster recovery capabilities. The system shall support secure, role-based access over both wired and wireless government-furnished network infrastructure, including thin-client terminals and tablets used in correctional institutions.

Vendors shall clearly identify any client-side technical requirements, such as supported web browsers, mobile device compatibility, or plug-ins.

3.2 Storage

The solution shall provide the FBOP with the capability to store, manage, share, redact, protect and dispose of digital evidence, most typically in the form of video, photo and audio records. The FBOP requires that this capability be provided as a cloud-based solution, consistent with federal cloud strategies. The FBOP prefers that said cloud-based solution be in the form of a Software-as-a-Solution (SaaS). SaaS is a software distribution model in which the application shall be hosted, by a vendor or service provider, and made available to customers over a network, typically the internet. If the vendor offers a SaaS solution, the FBOP shall expect to purchase licenses and support to utilize the software. Any cloud-based solution that is proposed (whether as an infrastructure, platform, or SaaS solution) shall receive or have FedRAMP Authorization with an Authority to Operate (ATO) capability for impact level Moderate or High systems.

The solution shall be capable of storing content (recordings and applicable metadata) in the cloud for at least 30 days or longer to satisfy FBOP records retention requirements. The information provided shall represent best practices for data management and storage on the vendor’s system, for the purpose of effectively managing available storage and mitigating additional charges for storage to the extent possible.

3.3 FedRAMP Compliance

The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. The proposed solution shall obtain or be at least FedRAMP Moderate compliant as a cloud service provider (CSP). A FedRAMP and FBOP-compliant Authority to Operate (ATO) are required by FBOP prior to the solution going into production.

3.4 Privacy Act and FOIA Requirements

The system shall comply with all applicable DOJ and FBOP policies concerning the handling of PII. PII, including names, inmate IDs, staff credentials, IP addresses, assessment results, and training records shall:

• Be securely transmitted and stored,

• Be accessible only to authorized users based on least privilege access control,

• Include full audit logs for access, modification, and export activities.

Vendors shall describe how their system prevents unauthorized disclosure or misuse of PII, including:

• Role-based permissions,

• Session timeout and auto-logout settings,

• Multifactor authentication (MFA).

3.5 System Standards Compliance

The proposed LMS shall comply with all of the following system standards:

• Accessibility: Fully compliant with Section 508 of the Rehabilitation Act, including screen reader compatibility and closed captioning for video content.

• Interoperability: Support for SCORM 1.2, SCORM 2004, and/or xAPI (Tin Can API) content standards.

• Authentication and Access Control: Integration with Active Directory/LDAP for user provisioning and authentication.

• Audit Logging: Maintain audit logs of all user and administrative activity for at least three (3) years, with reporting capabilities.

• Data Integrity: Implement safeguards to protect data from loss or corruption during transmission, user input, or administrative action.

• System Maintenance: Support scheduled maintenance windows with advance notice and minimal service disruption.

• CJIS Compliance (Preferred): While not mandatory, solutions that can demonstrate Criminal Justice Information Services (CJIS) Security Policy alignment shall be favorably considered.

4.0 Assumed Milestone/Phases for initiative

Phase 1: Project Initiation and Planning

Phase 2: System Design and Configuration

Phase 3: Integration and Data Migration

Phase 4: Testing and Quality Assurance

Phase 5: Training and Change Management

Phase 6: Deployment and Go-Live

Phase 7: Post-Implementation Support and Continuous Improvement

5.0 IT Requirements

This section outlines the information technology requirements applicable to the Learning Management System (LMS) solution being sought by the Federal Bureau of Prisons (FBOP). All systems and services shall adhere to applicable federal mandates, security frameworks, and Bureau-specific operational constraints.

5.1 APPLICABILITY

All information systems deployed within the FBOP, or on behalf of FBOP to include contractor built and operated on-prem, private cloud systems, or government cloud, shall be developed to include support for the standards detailed in this section to the greatest extent possible regardless of whether the system shall be connected to the FBOP's administrative network (BOPNet). All systems shall be evaluated prior to acquisition and/or deployment to determine that each system supports the technical standards contained in this section. Approval to connect to BOPNet shall not be granted to any system that cannot support these standards unless a waiver has been granted by the CIO.

Additionally, all systems shall acquire an Authority to Operate (ATO) prior to use, and an Authority to Test (ATT) prior to system testing. Testing shall not leverage live data (shall use data created for the sole purpose of verifying functional capability and contain neither FBOP nor FBOP user information). A pilot, if needed, shall also be performed without the use of live data.

All the system environments, including development, test, quality assurance, integration, production, and any other environment related to the system, and reside within the authorization boundary.

5.2 OPERATING SYSTEMS, DATABASES, AND APPLICATIONS

5.2.1 OPERATING SYSTEMS AND DATABASES

All systems shall be developed to use FBOP standard workstations, laptops, and servers with versions of operating systems and databases that are supported by the OS/database manufacturer/developer and shall continue to be supported by the manufacturer/developer for at least three years after the FBOP system goes live. Any system that shall rely on an operating system and/or database that is no longer supported or shall be approaching its end-of-life or the end of extended support date before the contract expires, shall be prohibited from being installed unless a waiver is granted by the CIO.

All devices shall have Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) Category I and Category II settings applied, if applicable.

Workstations and laptops with Windows operating systems shall have DISA STIG settings applied for the versions of Windows currently in standard use in the FBOP. Servers, workstations, laptops, and other devices running non-Windows operating systems shall be approved for use by the FBOP CIO prior to acquisition and shall be the latest supported versions by the vendor. If a DISA STIG exists for any non-Windows operating system, the operating system shall be configured in accordance with that DISA STIG.

5.2.2 APPLICATIONS

All systems on the FBOP network shall be capable of using a FBOP standard image for workstations. Systems shall be developed to minimize the installation of new applications directly onto workstations. Systems that require a client application be installed on workstations are strongly discouraged.

Web-based applications shall be installed on standard FBOP servers running FBOP-approved server operating systems and meet the following requirements:

Support TLS (non-deprecated version);

Be browser-agnostic;

Not require browser plug-ins, helper objects, specific ActiveX controls, or Java dependencies on the client.

All applications shall be able to operate with the latest version of any supporting applications or services required to run that application (i.e., Java, Apache, IIS, etc.).

5.2.3 AUDITING/LOGGING

All operating systems and/or applications shall be capable of auditing events and maintaining logs with sufficient information to be able to account for the actions of individual users and record system events and processes.

5.2.4 IDENTIFICATION, AUTHENTICATION, AND AUTHORIZATION

To comply with Homeland Security Presidential Directive 12 (HSPD-12), all information systems shall use a centralized directory for identification, authentication, and authorization to control, provision, and de-provision access to those systems. To connect to the FBOP network, all information systems shall be capable of supporting Lightweight Directory Access Protocol (LDAP v3 or successor).

Systems that cannot support either a FBOP directory service or DOJ federated service and require the management of a separate credential store for identification, authentication, and authorization are prohibited.

Each system user shall be uniquely identified. Access to information is controlled using a “Least Privilege” role- or assignment-based methodology that provides the user with only the information and access required to perform his/her duties and nothing more. Systems shall be capable of tiered-role privileges that distinguish between users and administrators and their authorized functions.

The federal government has implemented a Zero Trust security model to enforce least privilege per-request access decisions in information systems and services. Therefore, authentication to the system shall be facilitated via the use of multi-factor authentication and access to the data controlled via role-based access.

Security (HSTS) to ensure this connection.

5.2.5 CLOUD SERVICES

Any system that shall connect to or be hosted in a non-FBOP cloud service shall use cloud service providers (CSP) that have been independently evaluated by an authorized FedRAMP 3PAO (Third Party Assessment Organization) and are FedRAMP-certified. The CSP shall provide the most current System Security Plan (SSP), Control Implementation Summary (CIS), Customer Responsibility Matrix (CRM), Security Assessment Report (SAR), and list of any open Plans of Actions and Milestones (POAMs) to the FBOP Chief Information Security Officer (CISO) for consideration. The CSP shall be required to receive an ATO from the FBOP Authorizing Official (AO) prior to use.

5.2.5.1 CLOUD APPLICATIONS – REQUIREMENTS FOR COTS AND CUSTOM

DEVELOPED

Contractors shall develop or provide administration and user guides for applications. All applications shall adhere to Section 508 accessibility standards.

5.3 SECURITY ASSESSMENT AND AUTHORIZATION COMPLIANCE

The FBOP shall conduct an Assessment & Authorization (A&A) of the system before the Chief Information Officer’s office issues an Authority to Operate (ATO) on the system.

Government project officers are responsible for ensuring their contractor-hosted or cloud-hosted applications are authorized to operate (ATO) in accordance with the Federal Information Security Modernization Act of 2014 (FISMA). This activity includes all planning, testing, and continuous monitoring activities associated with the system’s lifecycle. Most importantly, this means that the vendor shall be responsible for securing the resources to conduct required security testing, which for moderate or higher impact systems means using an independent third-party assessor qualified to conduct FISMA/FedRAMP audits. The FBOP shall not develop required FISMA/FedRAMP security documentation (except for assisting with the FIPS-199, e-Authentication, and Privacy Impact Assessment), or conduct any of the security testing for applications that are operated exclusively at contractor locations or hosted in the cloud. The extent of FBOP’s support for exclusively contractor- and cloud-hosted systems shall be advisory only.

A&A shall be the methodology by which an organization establishes and then demonstrates a sound, risk-based security posture for a specific system. The A&A process establishes the extent to which a particular design and implementation meet a set of specified security requirements defined by the organization, government guidelines, and federal mandates into a formal authorization package. This authorization package shall be reviewed by the Authorizing Official (AO) and a formal declaration of an information system accreditation shall be either granted as an Authorization to Operate (ATO) or ATO with conditions or outright denial of authorization to operate. For more information about A&A requirements for federal IT systems, please see NIST SP 800-37 Rev 2 (https://csrc.nist.gov/pubs/sp/800/37/r2/final).

When this assessment shall be conducted, the vendor may be required to answer questions, to participate in the A&A process and potentially implement any information security changes necessary to facilitate receiving an ATO for this system. The system shall be required to meet or exceed specific and relevant security requirements identified and detailed in the Security and Privacy Requirements documentation.

Where a follow-up action against a person or the FBOP after an incident involves legal action (either civil or criminal), the system shall ensure that evidence can be collected, retained, and presented to conform to the rules for evidence in accordance with Federal rules of civil or criminal procedures.

The system and any/all electronic and information technology procured through this effort shall be compliant with 29 U.S.C § 794d - Electronic and information technology (Section 508 compliance Amendment to the Rehabilitation Act of 1973) and the applicable accessibility standards at 36 CFR 1194. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at https://www.section508.gov/. Standards applicable to this requirement include Functional Performance criteria 1194.31 and Information, Documentation, and Support 1194.41.

Because of the above requirements, the contractor would be required to include Information Systems Security Officer (ISSO) resources as part of a future proposal to assist in the development of documentation for the ATO process. Such personnel shall be experienced and familiar with writing control implementation statements so that security controls can be appropriately and promptly assessed. The length of the ATO process shall be dependent on the outcome of the quantity and quality of resources proposed for the solution.

5.4 PRIVACY AND RECORDS MANAGEMENT

All systems shall be evaluated prior to ATT or ATO for privacy and records management requirements. An Initial Privacy Assessment (IPA) shall be completed and if FBOP Privacy and Records Management Branch, and DOJ Office of Privacy and Civil Liberties (OPCL) determines that the system collects, processes, stores or disseminates personally identifiable information (PII), a Privacy Impact Assessment (PIA) shall be done to evaluate the impact on the confidentiality, integrity, and availability of the system data. If required, the FBOP Office of General Counsel (OGC) shall prepare a System of Records Notice (SORN) to be published in the federal register prior to system’s deployment. All systems shall complete a Records and Information Management Certification (RIMCert) evaluation regardless of Personally Identifiable Information (PII) status.

Contractor shall be aware, for planning purposes, that the current FBOP ATO process can take 6 to 18 months to complete. The length of this time shall be dependent on the outcome of the IPA for the system.

5.5 SYSTEM INTERCONNECTIONS

DOJ requires that Components identify all system interconnections, both external and internal to DOJ. A system interconnection shall be defined as the direct connection of two or more IT systems for the purpose of sharing data and other information resources. All interconnections from one information system to another system outside of the respective accreditation boundaries shall have an approved Interconnection Security Agreement (ISA), and optionally a Memorandum of Understanding/Agreements (MOU/A). Both parties shall mutually agree on terms and conditions and define expiration requirements or timelines. The agreements define how security shall be maintained for the interconnection during its operation. Information systems are only permitted to interconnect with systems that have undergone a system authorization and have a current Authorization to Operate (ATO). If the Authorizing Official (AO) shall be the same for both interconnecting systems, an ISA or MOU/A is not required.

All contractors are required to comply with DOJ/FBOP background clearance requirements before being permitted to do any work under a FBOP contract. Contractors working remotely for the FBOP shall be issued contractor user accounts and PIV cards. Contractors shall be required to use government furnished equipment (computers) to access the FBOP network. To prevent loss of FBOP data, all email communications between contractor personnel and FBOP personnel shall be conducted using the FBOP’s email system.

6.0 Request for Information Response

Interested vendors are requested to submit a comprehensive response that addresses the following areas. The purpose shall be to assist the Federal Bureau of Prisons (FBOP) in evaluating market capabilities, pricing models, compliance posture, and technical solutions for the Learning Management System (LMS) initiative.

Please limit your submission to a maximum of 20 pages, including cover page, tables, and appendices. Responses shall be submitted electronically in PDF format to the point of contact listed in the RFI.

6.1 Company Overview

• Legal company name, address, and website

• UEI number

• Point of contact (name, phone, email)

• Business size and classification (e.g., Large Business, Small Business, 8(a), HUBZone, SDVOSB)

• Summary of core capabilities, relevant NAICS codes, and years in operation

6.2 LMS Product Overview

• Name and version of the proposed Learning Management System (LMS)

• Description of core features and architecture (cloud, SaaS, hybrid, etc.)

• Hosting model and FedRAMP authorization level (Moderate or higher required)

• User capacity and performance scalability

• Accessibility (508 compliance) and device/browser compatibility

• Offline capabilities (if any)

6.3 Technical Capabilities and Requirements Alignment

Provide a narrative explaining how your solution meets the following key requirement areas:

• FedRAMP authorization and information security compliance (FIPS 140-2, TLS, MFA)

• Data storage (including U.S.-based, encrypted, redundant architecture)

• Role-based access control and user provisioning

• SCORM/xAPI compatibility and content delivery

• Integration with Active Directory/LDAP, HR/payroll systems, or similar

• Reporting, analytics, and audit functionality

• User interface design and administrative tools

• Multilingual support and responsive design

• Course authoring, assessment, and certification management tools

• System support for training staff and incarcerated individuals

6.4 Implementation Strategy

• Deployment approach and timeline (phased, pilot, nationwide, etc.)

• Data migration methodology

• Configuration and customization options

• End-user training and documentation support

• Change management strategies

• Technical and helpdesk support availability

6.5 Security and Privacy Compliance

• FedRAMP authorization documentation (provide ID or link to marketplace listing)

• Security controls in place (NIST 800-53, FISMA, CJIS if applicable)

• Privacy Act and PII handling procedures

• Audit logging, retention, and incident response processes

• Disaster recovery and continuity of operations capabilities

6.6 Pricing Information

Provide high-level pricing estimates based on:

• Licensing model (e.g., per user, per institution, enterprise)

• Implementation and onboarding fees

• Data migration and integration costs

• Annual maintenance and support

• Optional modules or value-added services

Note: Detailed pricing is not being requested at this stage, but a rough estimate shall be required to support acquisition planning.

6.7 Past Performance

List up to three recent and relevant LMS implementations, preferably for:

• Federal, state, or local government agencies

• Correctional or justice environments

• High-security or FedRAMP-compliant cloud deployments

For each, include:

• Customer name and agency

• Project description, value, and duration

• Point of contact (name, email, phone)

• Description of outcomes or performance metrics

6.8 Questions or Concerns

Vendors are encouraged to:

• Identify any perceived barriers to entry, risks, or feasibility challenges.

• Provide suggestions for improving the draft requirements or acquisition approach.

• Recommend contract types (e.g., firm-fixed price, time-and-materials) or pricing structures.

6.9 Attachments (Optional)

Vendors may attach relevant documentation such as:

• System architecture diagrams

• Product brochures or data sheets

• Security compliance certificates (FedRAMP, FIPS 140-2, ISO 27001)

• Sample reports or dashboards

7.0 Disclaimer

The Bureau may continue conducting market research by scheduling an onsite, follow-up demonstration at the Bureau’s headquarters located in Washington D.C. of proposed solutions by select vendors to provide more detailed information and display functionality and/or methodology. If web/virtual conferencing shall be used for a remote demonstration, the following solutions would be supported: Cisco WebEx, and Microsoft Teams to be organized by FBOP employees only. Include specification sheets and product literature in the responsive materials. Interested parties shall not be reimbursed for any costs related to the development and submission of information in response to this RFI.

Be advised that providing responses to the RFI shall not automatically include the vendor in acquisition planning. Information provided by responsive vendors shall be used to further refine the Bureau’s specifications for any eventual solicitation for such tools and services.

This RFI is issued solely for information and planning purposes and does not constitute a Request for Quote (RFQ) or a promise to issue an RFQ in the future. This RFI does not commit the Government to contract for any supply or service whatsoever.

Further, the Bureau is not, at this time, seeking proposals and shall not accept unsolicited proposals. A response to this notice is not an offer and cannot be accepted by the government to form a binding contract. Respondents are advised that the U.S. Government shall not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI shall be solely at the interested vendor's expense. Responses to this RFI shall not be returned. All information received shall be for internal use within the Bureau and shall not be published. However, not responding to this RFI does not preclude participation in any future RFQ, if any shall be issued.

In addition, this RFI shall be intended solely for the use to improve communications between potential contractors and the Bureau. If for some reason, the responses are requested by outside parties (i.e. FOIA request); the information is not protected as source selection information (FAR

2.101 and 3.104). If you intend for the information to be exempt from disclosure under FOIA Exemption 4, indicate this in your response and on each page you want to be exempt.

Furthermore, indicate that your response shall be proprietary information that may not be used, reproduced, or disclosed to any other parties for any purpose without the expressed written permission of (Provide individual name and title).

8.0 Questions & Answers

Primary Contact: Stephen Pupillo, Contracting Officer Email Address: Spupillo@bop.gov

Secondary Contact: Paul Brown, Contracting Officer Email Address: P4Brown@bop.gov

All RFIs shall be clear, legible, and conform to the following requirements:

Times New Roman at a font size of twelve (12) points with a twenty (20) page limit. Offers shall notate pages which contain confidential/proprietary information. It is the Offeror’s sole responsibility to ensure their offers are received timely and pdf files are accessible, legible, and each individual file shall not exceed 12Mb size.

All questions regarding this RFI must be submitted to Stephen Pupillo at Spupillo@bop.gov by 08/06/2025. Responses to this RFI shall be emailed in PDF format, no later than 8:00AM (EST) on 08/07/2025, to Stephen Pupillo, Contracting Officer, at Spupillo@bop.gov.

mailto:Spupillo@bop.gov mailto:P4Brown@bop.gov mailto:Spupillo@bop.gov mailto:Spupillo@bop.gov