OAA-25-00002 RFI Attachment 1.pdf

Part 5 Specific Tasks The contractor shall provide services for:

5.1 Task 1 Management

The contractor shall manage the contract in an efficient manner that fosters communication with contractor staff, the NLS Contract Officer’s Representative (COR), the Department’s Contracting Officer (CO), the Department’s Contracting Specialist (CS), the NLS project staff, and data users.

5.1.1 Subtask 1.1 Management and Staffing Plan

The contractor shall submit for approval of the COR a detailed management and staffing plan that will ensure the effective accomplishment of all NLS tasks. The plan shall focus on how the contractor will hire, train, and maintain staff, manage day-to-day survey operations, and coordinate activities to prevent problems and bottlenecks and resolve problems as they occur.

The plan shall include scientific staff who are experienced in conducting and publishing social science research using longitudinal data, especially labor market activating over the life course, and have experience designing surveys. The scientific staff shall:

• Advise the NLS program on survey content and design issues, especially during design and planning. They may be asked to provide written feedback on content and attend ad-hoc design meetings conducted in-person or virtually.

• Coordinate with existing and potential survey stakeholders in the government, non-profit and private sectors on the development of survey topics, questions, and methods and use the NLS survey data.

The plan also shall include a detailed timeline for all activities that will take place over the course of this contract. The timeline shall include the dates of each milestone and describe the dependency relationships between various activities. Approval of the plan will depend on whether it provides for qualified staff and the efficient, effective training of all Contractor staff in the project’s objectives and the administration of the surveys.

Deliverables, Timing, and Submission

5.1.1 Management and Staffing Plan:

The contractor shall submit the management and staffing plan 45 business days after the effective date of this contract. Management and staffing of the field interviewers and managers shall be addressed in Survey Procedures Plan

5.1.2 Subtask 1.2 Document and Data Transfer sites

The contractor will maintain a secure file transfer protocol (sFTP) site for the easy transfer of confidential data and documentation between contractors and BLS. The Contractor will maintain a secure sharepoint site for the transfer of non-confidential materials.

Deliverables, Timing, and Submission

5.1.2.1 sFTP site

Within 30 days of effective date of this contract, contractors will give individual user names and passwords to (a) Information System Security Officer (ISSO), (b) BLS COR, (c) NLS System Owner.

User accounts will also be given to other subcontractors as requested by BLS

5.1.2.2 Sharepoint site

Within 30 days of effective date of this contract, contractors will create a sharepoint site to be used by NLS staff for review and transfer or non confidential materials.

5.1.3 Subtask 1.3 Records Management

Records management plays a critical role in transparency and open government consistent with law and policy, to disclose information rapidly in forms that the public can readily find and use. This includes records created by the NLS program, the secure storage, maintenance, and accountability of these records, and the proper use and final disposition of these records.

Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

In accordance with 36 CFR 1222.32, all data created for government use and delivered to, or falling under the legal control of, the government are Federal records subject to the provisions of 44 U.S.C.

chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

In accordance with 36 CFR 1222.32, contractor shall maintain all records created for government use or created in the course of performing the contract and/or delivered to, or under the legal control of the government and shall be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

NLS Program Office records management is aligned with the 36 CFR 1220.324 which is to ensure agencies must create and maintain authentic, reliable, and usable records and ensure that they remain so for the length of their authorized retention period. The NLS follows Statistical Programs Bucket Schedule N1-257-11-1, which was approved by NARA on January 29, 2013. The National Archives and Records Administration (NARA) provides mandatory instructions on how and when to maintain and dispose of operational records

1. Survey Methodology Files

• procedural manuals,

• technical memorandums,

• all data collectors’ training materials for both Field Managers (FMs) and

Field Interviewers (FIs),

• FI CATI manuals,

• FI training starter Kits,

• communication related to survey issues (such as discussions about sample representativeness, interview sample priorities etc.)

• all contractor discussions with PIs

2. Program Subject Files

• planning documents,

• internal explanatory statements regarding objectives, strategy, and methodology,

• monthly progress reports,

• documentation related to any procedural problems and recommendations,

• study reports or other methodological or analytical statements used in reviewing or revising procedures or operational processes,

• weighting plans,

• created variable plans, and

• geocode plans

3. Permanent Output Database Files

• full public use data set without PII, in asci, with associated programs to read said asci data set

• NLS Users guides in electronic form,

• data codebooks

• Questionnaires

5.1.3.1 NLSY79 R 32 Submission of Contractor Records

Contractor survey methodology files, program subject files and public use output database: Records will be submitted in electronic form 14 months after the end of data collection upon release of the public use dataset in a FIPS 140-2 compliant manner.

5.1.3.2 NLSY97 R 23 Submission of Contractor Records

Contractor survey methodology files, program subject files and public use output database: Records will be submitted in electronic form 14 months after the end of data collection upon release of the public use dataset in a FIPS 140-2 compliant manner.

5.1.4 Subtask 1.4 Monthly Progress Reports

Although monthly reports shall be used to document problems encountered in addition to proposed solutions, the contractor shall not wait to communicate problems to the COR in the monthly report.

The contractor shall inform the COR of challenges being faced on a flow basis as challenges arise.

5.1.4. Monthly Progress Report

The monthly report shall be submitted by electronic transmission. It shall be due on the 5th day each month (or next business day if the date occurs on a weekend or Federal holiday).

5.1.5 Subtask 1.5 Management Conference Calls

The contractor shall prepare for and participate in conference calls with the NLS Director, COR and other BLS staff on a regular basis to discuss survey operations.

These calls may occur every one to two weeks as needed and agreed upon by the COR and contractor. The contractor can expect a typical call to last one hour or less. The contractor shall distribute the minutes of the prior conference call with the agenda for the next call.

5.1.5.1 Meeting Agenda

The contractor shall distribute the agenda and all supporting materials to call participants at least one workday prior to the meeting.

5.1.5.2. Meeting Minutes

The contractor shall distribute the minutes of the prior conference call with the agenda for the next call.

5.1.6 Subtask 1.6 Quarterly Survey Management and Design Meetings The contractor shall prepare for and participate 4 times yearly to discuss the management of the NLS program, as well as the design of questionnaires and procedures for future administrations of each survey. The length of these management meetings generally shall be limited to one day each unless otherwise agreed upon by the COR and contractor. Meetings shall take place by telephone, video conference or other electronic means unless otherwise agreed upon by the COR and contractor.

At these meetings, staff from BLS and the contractor and other invitees shall discuss general administration of the NLS program and each individual survey, as well as design and methodological issues for each survey. Topics for the management portion of each meeting may include a discussion of costs and current and anticipated budgets, survey operations, the status of contract deliverables, program timelines, initiatives to improve services to data users, and other topics.

Prior to each meeting, the contractor shall determine which of its staff members are expected to attend, and the contractor shall inform the NLS Director of the expected attendees. The NLS Director and Contractor also shall decide whether other persons besides BLS and contractor staff shall be invited to attend. The contractor shall suggest potential agenda items at least 4 weeks before the meeting. The contractor shall distribute meeting materials requested by the COR 3 days prior to the meeting.

The COR shall distribute the agenda approved by the NLS Director and all supporting materials to meeting participants at least two workdays prior to the meeting. The contractor shall submit the minutes of each meeting to the NLS Director and COR within one week after the meeting. The minutes shall summarize the discussion, focusing on decisions made, problems identified, and activities to be performed, including a designation of the responsible party and the due date.

Deliverables, timing and submission

5.1.6.1 Contractor provided Quarterly Management Meetings (QMM) meeting topics Agenda topics shall be submitted to the COR 4 weeks prior to the QMM.

5.1.6.2 Contractor provided meeting materials

The contractor shall provide COR requested meeting materials 3 days prior to the meeting.

5.1.6.3 Meeting minutes

The contractor shall take the minutes at the NLS QMM and submit them to the COR for review within one week after the meeting.

5.1.7 Subtask 1.7 Advisory Services

Survey programs with the scope, complexity, and importance of the National Longitudinal Surveys require input and guidance from a large number of individuals and organizations to address the data needs of researchers and policymakers. Each NLS survey will have a Principal Investigator (PI), responsible for advising on the content and methodology of the survey and promoting the survey to the academic community.

The Contractor shall arrange for a different Principal Investigator for the NLSY97 and NLSY79, per the approval of the Director. Each of the Principal Investigators shall have considerable experience conducting and publishing social science research using longitudinal data in general and NLS data in particular and should have experience designing surveys. The duties of the Principal Investigators shall include advising the NLS Director, BLS staff, and members of the research and policy communities to identify appropriate topics to include in each survey.

The Principal Investigators shall advise staff members from the Contractor, BLS, and other Government agencies and private organizations on the development of survey questionnaires and methods. The Principal Investigators shall advise the BLS on how best to promote the use of survey data among researchers and policymakers.

Deliverables, timing and submission

5.1.7.1 The Contractor shall provide a list of potential Principal Investigators for the NLSY79 and the NLSY97 these shall be delivered within three months of the NLS Director’s request. Selection will be made by the vendor with the approval of the NLS Director.

5.1.7.2 PI Guidance for Surveys

The PI for each survey shall advise the program on survey content and design issues, in particular during the design and planning phases of each Round. They will be asked to provide written guidance for content changes and attend ad-hoc design meetings conducted by phone

5.1.7.3 Liaison with Stakeholders: written summary

Each PI shall coordinate with existing and potential survey stakeholders in the government, non-profit and private sectors on the development of survey topics, questions, and methods. A written summary of these activities shall be presented at each Quarterly Management Meeting meeting.

5.1.7.4 Report on Survey Promotion

Each PI shall advise the BLS and Contract staff on how best to promote the use of NLS survey data.

They shall provide written recommendations during the 3rd quarter QMM [Summer, July ]

5.2 Task 2 Information Task 2 Technology Security Requirements for BLS Data and Systems The confidentiality of individually identifiable information contained in project documents, data, and other information supplied by the National Longitudinal Surveys Program, Bureau of Labor Statistics, U.S. Department of Labor, or information acquired in the course of this contract must be maintained, secured, and protected from disclosure as provided. The contractor shall maintain the confidentiality, integrity, and availability of all Bureau of Labor Statistics (BLS) data and systems and their associated hardware, software, and processing capabilities. The contractor shall develop and implement a security program, as approved by the COR, and designate an information security point of contact, to fulfill all security requirements under this contract.

The contractor shall enforce strict procedures for assuring data confidentiality and security. These procedures shall apply to all phases of the project and shall include but not be limited to: information used to locate study respondents, data collection in the field, coding and editing phases of data prior to machine processing, safeguarding response documents, and maintenance of any respondent follow- up information.

The contractor shall physically separate the identifying data required for any respondent follow-up from data required for research purposes.

Telework:

The contractor agrees not to access the NLS system remotely without written approval of the COR.

Requests for remote or telework work are dependent upon the submission and BLS approval of a detailed plan that incorporates all security requirements and showing access utilizes BLS and NIST approved encryption standards on contractor-owned and -maintained computer equipment. No personally owned computer equipment can be used by the contractor. Approval of the contractor’s remote or telework access is at the sole discretion of BLS and must be received in writing by the COR before any such access can take place.

5.2.1 Subtask 2.1 Confidential Information Protection and Statistical Efficient Act (CIPSEA) BLS assures participating individuals that any information collected is protected in accordance with the Confidential Information Protection and Statistical Efficiency Act (CIPSEA), the Privacy Act, and other applicable Federal Laws.

Due to the possible exposure to information protected by law under CIPSEA, the BLS shall, in accordance with this contract, designate contractor employees with exposure to BLS confidential information (NLS data) as agents of the BLS. All such agents are subject to the fines and penalties under 44 USC Section 3572 of CIPSEA and any other fines and penalties that apply to the mishandling of confidential information. The obligation to protect information extends to all CIPSEA-and Privacy Act-protected information including, but not limited to, information previously collected by the BLS and provided to the contractor in order to perform work under this contract, information collected on behalf of the BLS under this contract, and any work that may involve comingling or otherwise using CIPSEA-protected information alongside other data, such as supplemental survey information.

The contractor shall provide the contract employees with instructions on maintaining the security of all confidential information in accordance with this contract and applicable requirements outlined in the attachment “BLS Confidentiality and Security Requirements”. Such instructions are subject to the review and approval of the BLS upon request.

Deliverables Timing and Submission:

5.2.1.1 Potential BLS Agent List:

Within 30 days of contract award, the contractor will furnish to the BLS a list of contractor employees who the contractor believes require access to BLS confidential information in order to perform work on the contract. Under this contract, all contract employees with exposure to BLS confidential information (NLS data) shall become BLS Agents and take BLS confidentiality training before accessing BLS confidential data. This list must be updated as new employees begin work on the contract.

5.2.1.2 Annual Training Recertification Reports:

For the life of the contract, all BLS agents currently working this contract during the recertification period will take confidentiality training at least once a year. This annual recertification will begin in the summer and end by September.

5.2.1.3 BLS Agent Status Worksheets:

The contractor will keep records on current Agent designations and will report such information promptly to the COR upon request, but at least Quarterly (Oct 1, Jan.1, April 1, July 1). BLS will provide an excel worksheet for this process.

5.2.1.4 Worksite Location list:

Within 30 days of the contract award, the contractor shall provide the COR a list of all worksites, including telework sites, for approval at the start of work provided for in this contract and subsequent task orders. During the duration of the contract, the contractor shall notify the COR in writing of any proposed changes (additions or deletions) to the list of worksites.

5.2.2 Subtask 2.2 Compliance with Federal, Department and Agency Policies The Federal Information Security Modernization Act of 2014 (FISMA) tasked the National Institute of Standards and Technology (NIST) with providing minimum security requirements for the protection of sensitive information while residing in nonfederal information systems. The contractor agrees to ensure that all contractor-owned systems used to store or process data under this agreement comply with all applicable information security directives, acts, laws, regulations, standards, and guidelines.

They shall implement any revisions to the requirements described below, within one year of BLS implementation after receiving BLS guidance, or other timeframe as indicated by the COR, and at no additional cost to the government. In instances where the contractor finds that a security control does not apply, the contractor may request an exception. Any exceptions must be approved in writing by the BLS and approved by the COR.

To ensure that security controls for all BLS information systems are properly selected, authorized, implemented, and maintained in compliance with Federal requirements, the contractor and all sub-contractors shall comply with the BLS IT security policy and confidentiality and security requirements, per the following documents, OMB memos and federal directives. Aside from NIST 800-53, some documents contain restricted access data and are therefore considered confidential and will only be made available to the contractor selected upon award.

A. NIST Special Publication 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations.”

The contractor shall ensure implementation of the respective security controls catalogued in the current version of NIST 800-53 for a “Moderate” baseline system. These controls shall be subject to assessment and testing guidance provided in NIST Special Publication 800-53A, “Assessing Security and Privacy Controls in Federal Information Systems and Organizations.” Per NIST 800-53A, BLS reserves the right to request the system security plan at any time and any associated plans of action for any planned implementation or mitigations. In instances where the contractor finds that a security control does not apply, the contractor may request an exception.

Any exceptions must be approved in writing by the BLS.

B. OMB Memo M-22-09 - Moving the U.S. Government Toward Zero Trust Cybersecurity

Principles

This memorandum sets forth a Federal zero trust architecture (ZTA) strategy, requiring agencies and their contractors to meet specific cybersecurity standards and objectives by the end of Fiscal Year (FY) 2024 to reinforce the Government’s defenses against increasingly sophisticated and persistent threat campaigns. Those campaigns target Federal technology infrastructure, threatening public safety and privacy, damaging the American economy, and weakening trust in Government.

The contractor shall ensure implementation of the respective requirements catalogued in OMB M-22-09 including:

• Designating a Zero Trust Strategy implementation lead for the contractor. BLS will rely on the designated contractor zero trust leads coordination and for engagement with BLS and DOL on planning and implementation efforts within the contract for zero trust requirements.

• Submit a Zero Trust implementation plan for FY23-24

The contractor must develop a zero-trust architecture plan that describes how the contractor plans to implement Zero Trust architecture requirements in accordance with OMB Memo M-22-09 for the NLS System.

A zero-trust architecture plan must include the following detailed information:

• Plans to employ centralized identity management systems for agency users that can be integrated into applications and common platforms.

• Plans to require NLS users to use a phishing resistant methods to access NLS accounts.

• Plans to incorporate at least one device-level signal alongside identity information about the authenticated user.

• Plans to create ongoing, reliable, and complete asset inventories.

• Plans to use encrypted DNS for the NLS System where ever it is technically supported.

• Plans to enforce authenticated HTTPS for all NLS HTTP traffic, including traffic that does not cross the public internet.

• Plans that describe how the contractor plans to isolate NLS applications and environments through micro segmentation.

• Plans to work with BLS to transition NLS.org to NLS.gov in order to comply with M-22-09 and the federal DotGov program at CISA to “preload” agency-owned .gov domains as HTTPS-only in web browsers.

• Plans to include application security practices in the System authorization process by employing both automated analysis tools and manual expert analysis to perform security analysis on applications prior to authorization.

C. M-20-32 - Improving Vulnerability Identification, Management, and Remediation

This memorandum provides Federal agencies and their contractors with guidance for obtaining and managing their vulnerability research programs. Implementation will allow for the security research. community ("reporters") to report vulnerability information to appropriate contractor contacts, who can then use the reports to mitigate associated risks of which they may not have been aware.

The contractor shall ensure implementation of the respective requirements catalogued in OMB M-20-32 including:

• The contractor shall take affirmative steps to develop a Vulnerability Disclosure Program

(VDP), pursuant to CISA's implementation guidance as a baseline for vulnerability identification, management, and remediation. Beyond these initial actions, The contractor shall work with BLS to improve the maturity, scope, and interconnectivity of their VDPs, and integrate applicable policies and guidance into their overall cybersecurity risk management programs.

• The contractor shall publish and operationalize a VDP within 6 months of the award.

Thereafter, the contractor must work with BLS and CISA to continue maturing the processes developed for their VDPs and incorporate their VDP findings and remediation activities into their overall information security program.

• The contractor shall develop implementation plans providing timelines and milestones for VDP to cover all NLS systems.

D. M-21-31 - Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents

This memorandum was developed in accordance with and addresses the requirements in section 8 of the Executive Order for logging, log retention, and log management, with a focus on ensuring centralized access and visibility for the highest-level enterprise security operations center (SOC) of each agency and their contractors. In addition, this memorandum establishes requirements for agencies including contractors to increase the sharing of such information, as needed and appropriate, to accelerate incident response efforts and to enable more effective defense of Federal information and executive branch departments and agencies.

The contractor shall ensure implementation of the respective requirements catalogued in OMB M-21-31 including:

• The contractor upon award must immediately begin efforts to increase performance in accordance with the requirements of OMB 21-31 for Enterprise Logging Maturity.

Specifically, the contractor must assess their maturity against Enterprise Logging maturity model in memorandum 21-31 and identify resourcing and implementation gaps associated with completing each of the requirements listed below and repot them to BLS.

• The Contractor shall:

o By October 2025, achieve EL3 maturity.

o Provide, upon BLS request and to the extent consistent with applicable law, relevant logs to share with the Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI). This sharing of information is critical to defend Federal information systems.

o Share log information, as needed and appropriate, with BLS, DOL, CISA, or FBI to address. cybersecurity risks or incidents.

E. M-22-01 Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal

Government Systems through Endpoint Detection and Response

This memorandum provides implementation guidance to agencies and their contractors as they accelerate the adoption of EDR solutions and work to improve visibility into and detection of cybersecurity vulnerabilities and threats to the Government, as defined in EO 14028.

The contractor shall ensure implementation of the respective requirements catalogued in OMB M-22-01 including:

• The contractor shall Within 120 day of contract award conduct an analysis, in coordination with BLS, to assess the current status of their EDR capabilities by identifying any gaps in existing EDR deployments and provide a report to BLS including details and status.

• The contractor shall coordinate with BLS for current and future EDR solution deployments to confirm that the solution is approved and aligns with CISA’s technical reference architecture and appropriate data is gathered from the widest number of endpoints.

• The contractor shall provide BLS with visibility upon request into to their current and future EDR solutions to enable proactive threat hunting activities and a coordinated response to advanced threats, and to facilitate, as appropriate, network access for BLS, CISA, or FBI personnel to gain access to contractor EDR platforms if a critical need arises.

• The contractors shall ensure that ED solutions are implemented with sufficient dedicated resources to support the EDR requirements defined in this section, and it operated by staff with training in operating EDR. The contractor shall ensure that endpoint data is consolidated, retained, and archived in a manner that supports analysis and insight, to be defined in the technical reference architecture developed by CISA.

F. The DOL Cybersecurity Policy Portfolio (CPP)

The CPP is largely based on NIST 800-53, provides policies and procedures that establish uniform policies, authorities, responsibilities, and compliance for system security planning in accordance with NIST standards and other Federal requirements. The CPP also defines Department-specific security control parameters and include additional guidance on incorporating Federal security standards into information systems owned or operated on behalf of the Department of Labor (DOL). The provisions of DOL policies pertain to all BLS information systems. These documents will be provided upon award.

All periodic reports and updates regarding the NLS system are coordinated by BLS staff, but the NLS contractor and its subcontractors are expected to contribute all pertinent information about the security of the NLS system components under the management and control of the contractor or subcontractors. This list is subject to change during the life of the NLS contract depending on any changes to Federal legislation, policies, guidelines and standards.

The contractor shall update security documents in the event of any major system changes, incident reports, newly discovered vulnerabilities, or weakness mitigations. The contractor shall produce additional security documentation consistent with NIST 800-53 standards upon request by the COR at no additional cost to the government.

Deliverables Timing and Submission:

5.2.2 Periodic updates of all security documentation as requested by the COR or ISSO

5.2.3 Subtask 2.3 NLS System Assessment and Authorization Activities:

Ongoing Authorization, Continuous Monitoring and Self Security Assessment Department of Labor policies require Assessment and Authorization (A&A) of all information systems that process sensitive information. The A&A process ensures that the system owner documents all of the known security risks inherent in operating a system and obtains approval from the BLS leadership to operate that system with those known risks and any mitigation plans to reduce the risks. The Department developed the A&A policies and procedures to ensure controls are properly implemented and maintained.

Ongoing Authorization is the process developed to promote a better understanding of agency-related mission risks resulting from the operation of information systems on a continuous basis.

To ensure that proper measures have been taken to secure federal information systems, BLS senior management is required to authorize the processing of each information system prior to placing the system into operational phase. Ongoing Authorization is not tied to a termination date but rather remains valid until a significant change occurs altering the risk profile of the system or an event trigger indicates an information security risk above an acceptable level. During the Authorization period, however, additional tasks must be performed to ensure that the conditions underlying the Authorization do not change. These tasks include the continuous monitoring of security controls, regular security assessment, and completion of security documents as required.

By NLS and its contractor(s) performing these tasks, BLS senior management can maintain reasonable confidence that the information resources are properly protected and are able to meet the mission of the agency.

The contractor is expected to monitor security controls continuously and to assess system security periodically to identify and mitigate risks. The NLS system shifted to Ongoing Authorization in June 2021.

As part of ongoing A&A activities, a Security Self-Assessment (SSA) is conducted annually. The NLS contractor and subcontractors are expected to assess mandatory managerial, operational, and technical elements. The NLS contractor and subcontractors are expected to cooperate with BLS staff to coordinate interview schedules; provide applicable documentation or copies; and set up time for observation of applications to demonstrate application functions and controls. The contractor shall support security inspections conducted by government auditors or other government representatives, as designated by the BLS, at no additional cost. The contractor shall permit security inspections of its approved worksites, system configuration, and operating environment to ensure a secure operation and protection of Federal information processed by any system or operation supporting BLS data collection or processing.

5.3.1 NLS System Assessment supporting Ongoing Authorization (OA).

The NLS is currently operating under OA. If the NLS does not already have a signed Authority to Operate (ATO), within 6 months of contract award, the contractor based NLS system will undergo the full Assessment by the contractor and Authorization by the BLS Agency Head, who must approve its operation. This must be completed before any data can be placed in the system. Consistent with OA, if needed because of a major change to the system, the system will be reassessed by the contractor and reauthorized by BLS. NOTE: A major change to the system may trigger a re-authorization at any time

5.3.1 NLS Partial System NIST Security Self-Assessment, Annual In a Controls Audit, the contractor will show compliance on a subset of NIST controls selected by Department of Labor Office of the Chief Information Officer.

5.2.4 Subtask 2.4 Full NIST Security Controls Assessment (SCA) The Security Controls Assessment (SCA) is conducted every 3 years, at a minimum, as part of the A&A process described above. Staff from BLS or a third-party contractor will assess the managerial, operational, and technical elements, completing a full FISMA audit of all applicable NIST 800-53 controls for a Moderate system. The NLS contractor and subcontractors are expected to cooperate with the Security Controls Assessment team to coordinate interview schedules; provide applicable documentation or copies; and set up time for observation of applications to demonstrate application functions and controls. The next SCA of the NLS system supporting Ongoing Authorization will occur in the early spring of 2026.

Deliverables Timing and Submission:

5.2.4 NLS Independent Full System Audit, At least every 3 years, or as requested by BLS, the Contractor will fully assist an outside auditor to complete a full FISMA audit of all applicable NIST 800-53 controls for a Moderate system.

5.2.5 Subtask 2.5 Plan of Action and Milestones (As needed)

The contractor shall document the contractor’s efforts in identifying, assessing, prioritizing, and monitoring the progress of security efforts, vulnerabilities, and corrective actions for fixing or mitigating security weaknesses found in operations, or operating environments of any systems involved in storing, processing, or collecting BLS data. This information should be recorded in the form of a Plan of Action and Milestones (POA&M) and should be updated when a security weakness is found on the NLS system. The POA&M describes a weakness and the steps planned for resolving or mitigating the weakness. Each step also includes a planned completion date. The contractor shall promptly report defects or deficiencies to appropriate supervisory and/or security personnel for follow-up action. For a weakness to be resolved and removed from the POA&M, the NLS program must provide evidence demonstrating the resolution of the weakness.

The POA&M should be accompanied by a security progress report that demonstrates that the contractor has reviewed the audit trail, listed major security issues highlighted in the review of the audit log, and described the contractor’s action(s) on those security issues.

5.2.5 Plan of Action and Milestones (Ongoing)

Templates and instructions for documenting POA&Ms will be provided to the contractor by the NLS ISSO. As needed, POA&Ms will be continually monitored, with progress updates required quarterly. If there are no POAMS, no reports will be required.

5.2.6 Subtask 2.6 System Security Plan (SSP)

The contractor shall develop and document a formal plan detailing the security policies, procedures, and controls required for any systems involved in storing, processing, or collecting BLS data, as required. The System Security Plan (SSP) shall be completed and submitted to the NLS ISSO within the first quarter following the contract award. The SSP shall be updated annually or upon major changes to the system or system environment. The SSP shall address all management, operational, and technical controls specified in NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems: Minimum Security Controls, Moderate Baseline. The contractor shall implement all security controls as prescribed by NIST and shall report to and seek approval from the BLS for any deviations from NIST 800-53. To provide assurance that the implemented controls are operating as intended, the contractor shall follow NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems.

The purpose of System Security Plan (SSP) is to ensure controls are properly selected, authorized, implemented, and maintained in accordance with NIST standards. The SSP lists all controls for the NLS system and specifies their implementation status.

Deliverables Timing and Submission:

5.2.6 The System Security Plan (SSP)

The SSP shall be completed and submitted to the NLS ISSO within the first quarter following the contract award. The SSP shall be updated at least annually or upon major changes to the system or system environment, or as requested by BLS.

5.2.7 Subtask 2.7 Configuration Management Plan

A Configuration Management (CM) plan must be established, documented, maintained, and applied to the NLS system. The appropriate hardware, software, and procedural configuration mechanisms must be defined and developed during the Planning & Requirements Definition Phase of the system development life cycle. The CM plan must be updated and maintained throughout the remaining life cycle phases for the system. The information system personnel and information system must develop a baseline configuration and inventory, control and monitor configuration changes, enforce access restrictions and least functionality, and configure security settings.

The contractor may use a combination of commercially available software and custom developed software established under the secure software development framework defined in NIST SP 800-

218. The commercially available software shall have been developed by major software vendors, be widely used, and be actively supported by the developer or other third parties. When selecting among competing commercial off-the-shelf (COTS) software products, the contractor shall choose software and versions that are free from known security vulnerabilities. The chosen COTS software shall reflect the standard commercial practice of industry. The contractor shall consult available security checklists or recommendation guides in selecting secure product configurations and parameter settings. Any custom developed software shall be developed in compliance with relevant NIST security requirements. After assembling the COTS and custom software elements of the system, the contractor shall undertake a thorough and methodical search for ways by which the security of the integrated system might be undermined. The government has the right to perform a similar analysis.

The contractor shall remedy any vulnerability found from the contractor’s review or the government’s review in a timely manner. The contractor will consult with the COR, System Owner and the ISSO on the usage of software applications.

The standard installation, operation, maintenance, update, and/or patching of software shall not alter the configuration settings from the NIST national checklist program repository (https://nvd.nist.gov/ncp/repository ). Any non-standard configuration settings must be approved by the BLS ISSO.

Applications designed for end users shall run with full functionality in the standard user context without elevated system administration privileges.

Deliverables Timing and Submission:

5.2.7 Configuration Management Plan

The CM plan must be updated at least annually and updated as needed between annual submissions.

5.2.8 Subtask 2.8 Contingency Plan and Testing

Contingency planning ensures that an information system can recover from processing disruptions, regardless of the source of the disruption. The contractor shall develop a contingency planning program in accordance with NIST SP 800-34, Contingency Planning Guide for Information Technology Systems.

Contingency planning documentation consists of three deliverables: Contingency Plan (CP), CP Test Report and the Business Impact Analysis.

i. The Contingency Plan shall include step-by-step procedures to be followed in the case of a major or minor disruption to normal operations. The contractor shall develop a CP that can be used to ensure that any systems involved in storing, processing, or collecting BLS data can continue to operate and perform its function, as needed, during and after any processing disruption, localized emergency, or large-scale disaster. The CP shall provide detailed procedures in the cases for loss of single files, loss of machines, and loss of the entire system.

ii. The CP shall be completed and submitted to the NLS ISSO within the first quarter following the contract award. The CP shall be updated annually or upon major changes to the system or system environment. The CP shall be maintained in a state of current operational readiness to ensure continuity of support if events occur that prohibit normal operations. Current operational readiness means that the contractor shall perform necessary reviews and updates to keep the CP current. The contractor may develop separate documents that, combined, provide the information required in the CP. A hardcopy of the combined and complete CP shall be maintained at both the primary contract site and at an off-site location.

iii. The Contingency Plan contains the NLS program’s detailed plans for responding to an incident that renders an information technology system partially or completely inoperable. The contingency plan is the repository for the NLS system’s business continuity and disaster recovery information, tasks, and procedures to be used when responding to interruptions of normal business operations and services.

iv. Additionally, the Contingency Plan must be tested and updated annually. Annual reviews must be conducted, and records of these reviews must be included with the Contingency Plan. The contractor shall conduct annual notification tests, and biannual technical and tabletop CP tests as required.

The contractor shall analyze test results, report to the NLS ISSO annually on the results of these tests in a CP Test Report, and subsequently modify the CP, as appropriate. The contractor shall present sufficient documentation and evidence of action in the CP Test Report to validate the findings presented. The test report shall include details on what elements of the CP and CP Test Plan did and did not work properly.

v. The Business Impact Analysis (BIA) is designed to characterize the system components, supported mission/business processes and functions, and note interdependencies. Based on this information, the agency must characterize the consequences of a disruption or system unavailability. As part of the contingency planning process, a BIA is developed to identify and prioritize system components as they correlate to the mission/business process(s) and essential function(s). The Business Analysis Plan will list system hardware and software, location, quantity, other resources needed to function, and links to other critical system resources.

Deliverables Timing and Submission:

5.2.8.1 Business Impact Analysis

Updated at least annually, usually in conjunction with the Contingency Plan and updated as needed between annual submissions.

5.2.8.2 Contingency plan

Updated at least annually and updated as needed between annual submissions.

5.2.8.3 Contingency plan testing

Will be completed at least annually at BLS direction.

5.2.9 subtask 2.9 Incident Response Plan The Incident Response (IR) Plan contains detailed information on how security incidents are handled, tracked, monitored, and reported. Annual reviews must be conducted. The contractor shall conduct annual tests as required. The contractor shall analyze test results, report to the NLS ISSO annually on the results of these tests in an IR Test Report, and subsequently modify the IR Plan, as appropriate.

The contractor shall present sufficient documentation and evidence of action in the IR Test Report to validate the findings presented. The test report shall include details on what elements of the IR Plan and IR Test Plan did and did not work properly

Deliverables Timing and Submission:

5.2.9 Incident Response Plan

Updated at least annually and updated as needed between annual submissions.

5.2.10 Subtask 2.10 Additional Government Reviews

BLS reserves the right to review and approve or disapprove any security safeguards instituted to comply with the requirements of this contract. BLS also reserves the right on behalf of itself and the government to conduct confidentiality and security compliance reviews as deemed appropriate to ensure compliance with all security policies and directives, including unannounced security inspections of the contractor's facilities and approved telework sites. In addition, the NLS system is periodically audited by the DOL Office of Inspector General (OIG). The OIG keeps DOL agency heads and the Congress informed about problems, deficiencies and corrective actions. These audits may involve inspection of the facilities, technical capabilities, documentation, records, databases, operations, and procedures provided for the performance of any work under this contract

The contractor shall support security inspections conducted by government auditors or other government representatives, as designated by the COR. BLS data physically and/or electronically maintained at the contractor’s worksites will be sufficiently segregated from any other confidential data the contractor maintains in order to facilitate BLS security inspections. No other obligations on the part of the contractor may restrict BLS access to contractor facilities where BLS confidential information is maintained. The contractor may not put forth legal qualifications for, or in any way restrict, BLS access to these systems or facilities for the purpose of determining compliance with contract requirement. On the basis of such security inspections, the COR may require specific measures in cases where the contractor is found to be non-compliant with contract requirements.

The contractor shall implement such measures as soon as possible without additional cost to the government and support additional reviews as necessary to confirm actions taken to correct defects and deficiencies.

The contractor shall remedy any vulnerability found from the contractor’s review or the government’s review in a timely manner.

Deliverables Timing and Submission:

5.2.10.1 Confidentiality and Security Compliance Reviews

Contractor shall assist as necessary with all Confidentiality and Security Compliance Reviews, including but not limited to audits, scans, as well as provide documentation and requested information in the time period allotted. Documents must pass review by BLS and/or an independent auditor.

5.3 Task 3 NLSY79 R32 OMB Submission

The Contractor shall assist NLS staff in developing the materials needed for OMB Clearance of the NLSY79 round 32 survey. This includes materials:

• Supporting Statement Part A

• Supporting Statement Part B

• Information collection instrument(s) (forms, web collection instruments, Computer Assisted Telephone Interview (CATI) and Computer Assisted Personal Interview (CAPI) scripts)

• Supporting documentation (statutes, regulations, studies, advance letters and emails, informed consent letters, planning information)

• Incentive and payment plans

• Addressing comments received during the clearance process (as needed)

As needed, the Contractor shall provide the necessary background information to complete these documents.

Allocate 10-12 months for the clearance process, after draft version has been approved by NLS staff.

Revisions to the package may be necessary based on feedback from BLS, DOL, and OMB reviewers, or public comments received during the 60-day Federal Register notice period.

5.3.1 NLSY79 R32 Main OMB Clearance Package

All requested OMB package documents, including the incentive plan and tables showing the expected cost of incentives. The Contractor shall provide all the necessary inputs, including a final draft of the materials, required for OMB submission, at a date to be determined in conjunction with the COR.

5.4 Task 4 NLSY79 Round 32 Interim Contact

To maintain respondent cooperation and maximize response rates, the contractor shall develop and implement methods to locate and contact NLSY79 respondents between Rounds of the survey.

Respondent contacts during non-field periods should maintain and improve respondent interest in the survey, enhance respondent recall, and update locator information without overburdening or alienating respondents.

5.4.1 Subtask 4.1 Interim Contact Plan

The contractor shall develop an interim contact plan for Round eligible respondents. The interim contact plan shall be delivered no later than 3 months after the end of the field period for the previous round.

The plan shall include (but is not limited to) elements such as the type of interim contact (newsletter, interim survey, respondent…