MEDALS RFI.docx

1. PURPOSE

The Department of War (DoW), through the Defense Human Resources Activity and Defense Manpower Data Center (DMDC), is issuing this Request for Information (RFI) to obtain technical and operational input from qualified third-party vendors capable of serving as a secure data intermediary and service provider between multiple States, U.S. territories, federal agencies and the DoW. The purpose of this data exchange is to inform and improve student outcomes related post-secondary military enlistment and careers.

This RFI is being issued to inform the DoW and educational stakeholders on options for the implementation of role-based feasible, secure, and scalable services to:

· Utilize student-level high school graduate data from multiple State Education Agencies (SEAs);

· Management and standardization of state-specific data submissions for matching purposes;

· Develop a secure method to perform a data match between states and the DoW.

· Receive encrypted matched student-level data;

· Disaggregate matched data by state; and

· Return deidentified student-level match results to each submitting SEA for authorized analysis.

The anticipated North American Industry Classification System Codes (NAICS) is 518210 - Data Processing, Hosting, and Related Services. The anticipated Product Service Code (PSC) is DH10 - IT and Telecom - Platform As A Service: Database, Mainframe, Middleware..

2. BACKGROUND

DMDC currently supports limited, state-specific data matching pilots to identify high school graduates who enlist in the U.S. Armed Forces. As described in the Military Enlistment Data Access to Lift Student Success (MEDALS) Pilot Use Case and associated Data Use Agreement (DUA) <provided as Appendix N>, the long-term objective of this project is to establish a secure, replicable, and standardized methodology for confirming military service and careers as a postsecondary outcome for counseling, curriculum support, accountability and reporting purposes.

To support the scale and range of state approaches, consistency, and security across jurisdictions, DMDC is exploring the use of a trusted third-party intermediary to manage state access and licensing, encryption, aggregation, matching approaches, and state-level disaggregation while adhering to all applicable federal and state privacy, security, and data governance requirements.

3. SCOPE OF INTERMEDIARY SERVICES (CONCEPTUAL)

Respondents shall assume the following conceptual operational flow, consistent with existing DMDC–SEA DUA terms:

· Unidirectional, managed and secure data match between multiple state, territorial, and federal agencies and the DOW

· Vendor potential approaches to longer-term agreement requirements and expansion capabilities (e.g. bi-directional data exchange) scalability (e.g. adding multiple SEAs), and approaches (e.g. handling exceptions, continuous match improvement, and SEA payload specifics

· Secure receipt and validation of prior year(s) student-level graduate data from multiple states

· Validation, formatting, deidentification, and aggregation of state files

· Secure process to produce a consolidated file for the purpose of matching against DMDC enlistment data.

· Secure receipt of match results and payload files

· Disaggregation of results by state and creation of individual files for delivery

· Secure return of SEA-specific student-level match files

· Data retention and destruction of individual matching files and information in accordance with DOW and state agreement terms

· Analysis and recommendation of best practices related to matching files and algorithms that yield the best results.

4. TECHNICAL AND SECURITY REQUIREMENTS

Information Security Compliance Respondents shall describe their ability to comply with all applicable federal and DoW security and data disposition requirements, including:

· Federal Information Security Modernization Act (FISMA)

· Department of Defense Instruction (DoDI 8500.01 and 8510.01 (RMF))

· DoD Cloud Computing Security Requirements Guide

· Privacy Act of 1974 and Computer Matching and Privacy Protection Act of 1988 (CMPPA)

· National Institute of Standards and Technology (NIST SP 800-53, 800-61, and 800-88)

· Federal Information Processing Standards (FIPS 140-2 / 140-3)

· Federal Risk and Authorization Management Program (FedRAMP) (if approach is cloud-based)

· Family Educational Rights and Privacy Act (FERPA and Privacy Act of 1974) Data Storage and Transmission Responses shall address:

· Information security architecture and data storage/management approach

· De-identification, matching, and encryption approach and required/optional data to provide best-in-class results

· Secure file transfer or other match method mechanisms

· Encryption of data at rest and in transit

· U.S and U.S. territory based data residency

· Role-based access controls and auditing

· Incident response and breach notification procedures

· Internal data storage, management and destruction methods

· Provide user and stakeholder appropriate context for approach and technical information

5. DATA MATCHING METHODOLOGIES

Respondents shall describe potential non-proprietary approaches and multiple data matching options, including but not limited to:

Personally Identifiable Information (PII)-Based Matching

· First Name, Last Name, Date of Birth

· Optional use of Middle Name and Sex Social Security Number (SSN) Based Matching

· Full or partial SSN

· Alignment with DoW SSN reduction policies Privacy-Preserving / De-Identified Matching

· Tokenization or cryptographic hashing

· Secure multi-party computation

· No direct PII exchange between SEA and DoW Hybrid Approaches

· Tiered matching

· Confidence scoring Other Vendor specific approaches not previously envisioned by project stakeholders.

6. DATA GOVERNANCE, OWNERSHIP, AND PRIVACY

· All participating stakeholders retain individual ownership of SEA-submitted data files

· DoW retains individual ownership of DoW-derived data

· No secondary use or data disclosure is permitted or allowed

· Compliance with FERPA, and state law

· Timely data destruction and security protocols are employed per NIST, all applicable standards and federal/state laws

· Provide recommendations/supports in the governance and data management processes as a trusted intermediary (optional/possible)

7. AGREEMENT AND GOVERNANCE FRAMEWORK

Agreement Structure A hub-and-spoke agreement model is anticipated however other novel approaches may be provided they meet the following requirements:

· The third party holds the primary contract with DoW/DMDC

· The third party executes and manages individual standardized DUAs/licenses

· DUAs/licenses will be based on the MEDALS Workgroup-developed requirements

· All DUA/license terms, requirements, and conditions will be governed through MEDALS governing bodies Anticipated Financial Support Models Respondents shall provide approaches and possibilities for on-scale funding of multi-SEA and federal costs for:

· Administering the awarded DoW contract

· Approaches to annual SEA Costs for matching and delivery of resultant SEA data payload

· Possible SLA metrics used to measure success and continuous improvement

· Approaches to annual DOW Costs

· Assumptions used in creating financial investment model(s) Agreement Management Responsibilities Respondents shall describe processes for:

· Administering the awarded DoW contract

· Executing and tracking SEA DUAs/licensing

· Version control and renewals

· Audit and compliance support

· Responsibilities around governance and management of contracted services Prior Experience Respondents shall describe prior experience:

· Providing similar work in public or private industries with a brief description of the services provided

· Acting as a federal-to-state/federal agency/territorial intermediary

· Managing standardized licensing and/or DUA approaches across multiple organizations

· Handling FERPA and other confidential data

· Handling state and federal data privacy, security, and deidentification management at scale

· Managing risk and liability on large-scale deployments

· Providing support and services to multiple stakeholder groups of varying knowledge and capacities

8. MEDALS Standardized DUA Management Respondents shall describe their overall approach to managing stakeholder/DOW data sharing agreements. Please describe your approaches to:

· State, federal agency, tribal, and territorial onboarding

· Master agreement and state-specific approaches to DUA/license management

· Managing limited state-specific variations and legal requirements

· Ensuring consistent interpretation and application of DUA/license terms across the agreement term Alternate Contract Models (Optional) Respondents may propose alternate conceptual models and approaches discussing benefits, risks, management, and scalability. 9. VENDOR EXPERIENCE AND CAPABILITIES Respondents shall describe:

· Data management, security and DUA governance approaches

· Relevant organizational experience

· Staffing, security, and governance models

· Scalability to nationwide participation

· Prior customer reference accounts (Optional)

10. OPERATIONAL CONSIDERATIONS

Respondents are encouraged to address their approaches to:

· DUA Agreement/Licensing management

· Data security risk management

· Stakeholder and DOW onboarding timelines and approach

· Initial funding models and fiscal approaches for implementation and sustainability

· Anticipated match cycle frequency, scope, approach and turnaround

· State and DMDC training, support and professional service offerings

· Implementation and maintenance approaches

11. DISCLAIMER

This RFI, issued in accordance with Federal Acquisition Regulation (FAR) Part 10, Market Research, is for information, planning, and market research purposes only and does not constitute a commitment, implied or otherwise, that the DoW, or DMDC will issue a solicitation, award a contract or otherwise take any other procurement action. Additionally, a vendor’s response to the RFI – or lack thereof – will have no impact on the evaluation of responses to any subsequent Requests for Quotation (RFQ) that may be released in the future. Responses will be used solely for information and planning purposes. Please also note that all responses will be public record. Do not submit confidential or company-proprietary information in your response. This opportunity to respond does not constitute a solicitation for proposals, applications, proposal abstracts, or quotations. The Government assumes no financial responsibility for any costs incurred in responding.