NLSY27 DRAFT PWS 06.18.26.pdf

Part 5 Specific Tasks

Task 1 Management The contractor shall manage the contract in an efficient manner that fosters communication with contractor staff, the NLS Contract Officer’s Representative (COR), the Department of Labor (DOL)’s Contracting Officer (CO), the DOL’s Contracting Specialist (CS), the NLS project staff, and data users.

Subtask 1.1 Management and Staffing Plan The contractor shall submit for approval of the COR a detailed management and staffing plan that will ensure the effective accomplishment of all NLS tasks. The plan shall focus on how the contractor will hire, train, and maintain staff, manage day-to-day survey operations, and coordinate activities to prevent problems and bottlenecks and resolve problems as they occur.

The plan shall include scientific staff who are experienced in conducting and publishing social science research using longitudinal data, preferably NLSY data, especially transitions during adolescence and labor market activity over the life course and have experience designing surveys.

The scientific staff shall:

• Advise the NLS program on survey content, methodology, and design issues. They may be asked to provide written feedback on content and regularly attend design meetings conducted in-person or virtually.

• Coordinate with existing and potential survey stakeholders in the government, non-profit and private sectors on the development of survey topics, questions, and methods and use of NLS survey data.

The plan also shall include a detailed timeline for all activities that will take place over the course of this contract. The timeline shall include the dates of each milestone and describe the dependency relationships between various activities. Approval of the plan will depend on whether it provides for qualified staff and the efficient, effective training of all Contractor staff in the project’s objectives and the administration of the surveys.

Deliverable 1.1.1 Management and Staffing Plan The contractor shall submit the management and staffing plan 20 business days after the effective date of this contract. Management and staffing of the field staff shall be addressed in the Questionnaire Design and Planning, Pretest, and Main Data Collection Tasks.

Subtask 1.2 Secure FTP site The contractor will maintain a secure file transfer protocol (FTP) site for the easy transfer of data and documentation between contractors and BLS.

The contractor will utilize BLS provided MFT (currently Kiteworks MFT) and SFTP (securetransfer.bls.gov) for the secure managed transfer of data and documentation between contractors and BLS.

Subtask 1.3 Records Management Records management plays a critical role in transparency and open government consistent with law and policy, to disclose information rapidly in forms that the public can readily find and use while also ensuring the BLS is retaining records documenting official agency work activities in accordance with federal records management guidelines and disposition authorities. This includes records created by the NLS program, the secure storage, maintenance, and accountability of these records, and the proper use and final disposition of these records.

The contractor shall comply with all applicable records management laws, regulations, requirements, and policies established by the COR, BLS, and the broader Department of Labor in order to properly maintain and manage records associated with the contract.

Contractor shall comply with National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

In accordance with 36 CFR 1222.32, all data created for government use and delivered to, or falling under the legal control of, the government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

In accordance with 36 CFR 1222.32, the contractor shall maintain all records created for government use or created in the course of performing the contract and/or delivered to, or under the legal control of the government and shall be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

NLS Program Office records management is aligned with the 36 CFR 1220.324 which is to ensure agencies must create and maintain authentic, reliable, and usable records and ensure that they remain so for the length of their authorized retention period. The NLS follows Statistical Programs Bucket Schedule N1-257-11-1, which was approved by NARA on January 29, 2013. The National Archives and Records Administration (NARA) provides mandatory instructions on how and when to maintain and dispose of operational records.

1. Survey Methodology Files

• procedural manuals,

• technical memorandums,

• all data collectors’ training materials for both Field Managers (FMs) and FIs,

• FI CATI manuals,

• FI training starter Kits,

• communication related to survey issues (such as discussions about sample representativeness, interview sample priorities etc.)

• all contractor discussions with Principal Investigators (PIs)

2. Program Subject Files

• planning documents,

• internal explanatory statements regarding objectives, strategy, and methodology,

• monthly progress reports,

• documentation related to any procedural problems and recommendations,

• study reports or other methodological or analytical statements used in reviewing or revising procedures or operational processes,

• weighting plans,

• created variable plans, and

• restricted use plans

3. Permanent Output Database Files

• full public use data set without PII, in asci, with associated programs to read said asci data set

• NLS Users guides in electronic form,

• data codebooks

• Questionnaires

Deliverable 1.3.1 NLSY27 Submission of Contractor Records Contractor survey methodology files, program subject files and public use output database:

Records will be submitted in electronic form 1 year after the end of data collection upon delivery of the data files in a FIPS 140-2 compliant manner.

Subtask 1.4 Monthly Progress Report Although monthly reports shall be used to document problems encountered in addition to proposed solutions, the contractor shall not wait to communicate problems to the COR in the monthly report. The contractor shall inform the COR of challenges being faced on a flow basis as challenges arise.

Deliverable 1.4.1 Monthly Progress Report

The monthly report shall be submitted by electronic transmission. It shall be due on the 5th day each month (or next business day if the date occurs on a weekend or Federal holiday).

Subtask 1.5 Management Conference Calls The contractor shall prepare for and participate in conference calls with the NLS Director, COR and other BLS staff on a regular basis to discuss survey operations. These calls may occur every one to two weeks as needed and agreed upon by the COR and contractor. The contractor can expect a typical call to last one hour or less. The contractor shall distribute the minutes of the prior conference call with the agenda for the next call.

Deliverable 1.5.1 Meeting Agenda The contractor shall distribute the agenda and all supporting materials to call participants at least one workday prior to the meeting.

Deliverable 1.5.2 Meeting Minutes The contractor shall distribute the minutes of the prior conference call with the agenda for the next call.

Subtask 1.6 Quarterly Survey Management and Design Meetings The contractor shall prepare for and participate 4 times yearly to discuss the management of the NLS program, as well as the design and content of questionnaires and procedures for future administrations of each survey. The length of these management meetings generally shall be limited to one day each unless otherwise agreed upon by the COR and contractor. Meetings shall take place by telephone, video conference or other electronic means unless otherwise agreed upon by the COR and contractor. The contractor may propose in person meetings subject to approval by the NLS Director and/or COR.

At these meetings, staff from BLS and the contractor and other invitees shall discuss general administration of the NLS program and the NLSY27, as well as design, content, and methodological issues for the NLSY27.. Topics for the management portion of each meeting may include a discussion of costs and current and anticipated budgets, survey operations, the status of contract deliverables, program timelines, initiatives to improve services to data users, and other topics.

Prior to each meeting, the contractor shall determine which of its staff members are expected to attend, and the contractor shall inform the NLS Director of the expected attendees. The NLS

Director and Contractor also shall decide whether other persons besides BLS and contractor staff shall be invited to attend. The contractor shall suggest potential agenda items at least 4 weeks before the meeting. The contractor shall distribute meeting materials requested by the COR 3 days prior to the meeting.

The COR shall distribute the agenda approved by the NLS Director and all supporting materials to meeting participants at least two workdays prior to the meeting. The contractor shall submit the minutes of each meeting to the NLS Director and COR within one week after the meeting.

The minutes shall summarize the discussion, focusing on decisions made, problems identified, and activities to be performed, including a designation of the responsible party and the due date.

Deliverable 1.6.1 Quarterly Management Meetings (QMM) Agenda Contractor provided Quarterly Management Meetings (QMM) meeting topics Agenda topics shall be submitted to the COR 4 weeks prior to the QMM.

Deliverable 1.6.2 Meeting Materials The contractor shall provide COR requested meeting materials 3 days prior to the meeting.

Deliverable 1.6.3 Meeting Minutes The contractor shall take the minutes at the NLS QMM and submit them to the COR for review within one week after the meeting.

Subtask 1.7 Stakeholder Input and Outreach Survey programs with the scope, complexity, and importance of the National Longitudinal Surveys require input from a large number of varied stakeholders in the government, non-profit and private sectors to address the data needs of researchers and policymakers.

The Contractor shall engage a group of 3-5 subject matter experts to provide advice on the NLSY27 with respect to survey content, development, and usage. Members of the group shall be chosen in consultation with the NLS Director to capture a range of academic disciplines (e.g., economics, sociology, and psychology) and subject matter expertise (e.g., job search, education, human development, family dynamics, etc.). The NLSY27 subject matter experts will be responsible for gathering input from the stakeholder community and providing input to NLS on the content and methodology of the survey and promoting the survey to the stakeholder community. The subject matter experts shall be available for direct consultation with NLS staff, as needed.

The subject matter experts shall have considerable experience conducting and publishing social science research using longitudinal and/or survey data and should have experience designing surveys or other data collections as well as presenting scholarly research to the data user community. The duties of the subject matter experts shall include providing input to the NLS Director, NLS staff, and members of the stakeholder communities to identify appropriate topics to include in the NLSY27. The contractor may propose alternative approaches for providing equivalent expert consultation support, subject to BLS approval. All final decisions shall be made by the BLS.

Deliverable 1.7.1 List of Potential Subject Matter Experts The Contractor shall provide a list of potential subject matter experts for the NLSY27. The list shall be delivered within three months of the NLS Director’s request. Selection will be made by the vendor with the approval of the NLS Director.

Deliverable 1.7.2 Subject Matter Experts’ Guidance for Surveys The subject matter experts for the NLSY27 shall advise the program on survey content and design issues, in particular during the design and planning phases of each Round. They will be asked to provide written guidance for content changes and attend the design portion of the QMM meetings conducted virtually.

Guidance on what items to cut, add or modify shall be provided 2 weeks before the first design and planning meeting.

Deliverable 1.7.3 Outreach plan The contractor shall submit a plan for outreach by the Subject Matter Experts to existing and potential NLSY27 stakeholders in the government, non-profit and private sectors to solicit their input on the development of survey topics, questions, and methods and use of NLS survey data.

Deliverable 1.7.4 Liaison with Stakeholders: written summary at QMMS Each subject matter expert shall coordinate with existing and potential survey stakeholders in the government, non-profit and private sectors on the development of survey topics, questions, and methods.

A written summary of these activities shall be presented at each Quarterly Management Meeting (QMM).

Subtask 1.8 Promotion of the use of NLSY27 Data The contractor shall provide written recommendations to the COR on how best to promote NLSY27 data to the user community, including conference presentations, training opportunities for graduate students and researchers new to NLSY data, and profiles of the data set to appear in journals or newsletters.

Deliverable 1.8.1 Recommendations for Promoting the use of NLSY27 Data The contractor shall submit recommendations due three months prior to the release of the round-specific public use data.

1.9 Subtask 1.9 Errata

The contractor shall correct all errors and problems that are discovered in any data files. The contractor shall investigate all questions that arise concerning suspected errors in the data or the documentation. As errors are discovered, they shall be corrected and the contractor shall make such corrections available to researchers by posting the corrected data on the bls.gov/nls website. With permission of the COR, revisions may be delayed and included in conjunction with the release of an additional round of data.

Where there is a lack of clarity, apparent inconsistencies or omissions, or similar problems relating to the documentation, these problems also shall be corrected, and such corrections shall be provided to NLS users.

Within 5 business days of finding an error, email notification to COR and NLS Director with description of error, proposed remediation strategy and timing using an Errata form. The Errata form shall include:

• Cohort and either Public Use or Restricted,

• Who Discovered the Issue

• How the issue was Discovered

• Date Issue was reported

• Variables and Rounds Affected

• Description of Issue

• Proposed solution

NLS must approve the solution.

Deliverable 1.9.1 Errata Identification & Remediation Within 5 business days of finding an error, email notification to COR and NLS Director with description of error, proposed remediation strategy and timing using BLS provided Errata form.

Deliverable 1.9.2 Corrected Data available for Users After approval by BLS: Notification of error description and corrected variables placed in errata section of the website within 1 week of approval or complete reload of data if deemed necessary by the NLS Director or COR.

Task 2 Technology and Security Requirements for BLS Data and Systems The confidentiality of individually identifiable information contained in project documents, data, and other information supplied by the National Longitudinal Surveys Program, Bureau of Labor Statistics (BLS), U.S. Department of Labor, or information acquired in the course of this contract must be maintained, secured, and protected from disclosure as provided. The contractor shall maintain the confidentiality, integrity, and availability of all BLS data and systems and their associated hardware, software, and processing capabilities. The contractor shall develop and implement a security program, as approved by the COR, and designate an information security point of contact, to fulfill all security requirements under this contract.

The contractor shall enforce strict procedures for assuring data confidentiality and security. These procedures shall apply to all phases of the project and shall include but not be limited to: information used to locate study respondents, data collection in the field, coding and editing phases of data prior to machine processing, safeguarding response documents, and maintenance of any respondent follow- up information. The contractor shall physically separate the identifying data required for any respondent follow-up from data required for research purposes.

Subtask 2.1 Confidentiality Training Requirements Due to the possible exposure to information protected by law under the Confidential Information Protection and Statistical Efficiency Act of 2018 (CIPSEA), the BLS shall, in accordance with this contract, designate contractor employees with exposure to BLS confidential information (NLS data) as agents of the BLS. All such agents are subject to the fines and penalties under 44 USC Section 3572 of CIPSEA and any other fines and penalties that apply to the mishandling of confidential information. The obligation to protect information extends to all CIPSEA- and Privacy Act-protected information including, but not limited to, information previously collected by the BLS and provided to the contractor in order to perform work under this contract, information collected on behalf of the BLS under this contract, and any work that may involve comingling or otherwise using CIPSEA-protected information alongside other data, such as supplemental survey information.

The contractor shall provide the contract employees with instructions on maintaining the security of all confidential information in accordance with task order and applicable requirements outlined in the attachment “BLS Confidentiality and Security Requirements”. Such instructions are subject to the review and approval of the BLS upon request.

Deliverable 2.1.1 BLS Agent List and Designation Within 30 days of contract award, the contractor will furnish to the BLS a list of contractor employees who the contractor believes require access to BLS confidential information in order to perform work on the contract. Under this contract, all contract employees with exposure to BLS confidential information (NLS data) shall become BLS Agents upon approval of the COR.

Contractor staff designated as agents must sign a BLS agent agreement and take BLS confidentiality training before accessing BLS confidential data. This list must be updated as new employees begin work on the contract.

Deliverable 2.1.2 Annual Training Recertification Reports For the life of the contract, all BLS agents currently working task order during the recertification period will take confidentiality training at least once a year. This annual recertification will begin in the summer and end by September.

Deliverable 2.1.3 BLS Agent Status Worksheets The contractor will keep records on current Agent designations and will report such information promptly to the COR upon request, but at least Quarterly (Oct 1, Jan.1, April 1, July 1). BLS will provide an excel worksheet for this process.

Deliverable 2.1.4 Worksite Location list Within 30 days of the contract award, the contractor shall provide the COR a list of all worksites, including telework sites, for approval at the start of work provided for in task order and subsequent task orders. During the duration of the contract, the contractor shall notify the

COR inwriting of any proposed changes (additions or deletions) to the list of worksites. Any changes to the list of worksites must be approved in writing by the COR.

Subtask 2.2 Compliance with Federal, Department and Agency Policies The Federal Information Security Modernization Act of 2014 (FISMA) tasked the National Institute of Standards and Technology (NIST) with providing minimum security requirements for the protection of sensitive information while residing in nonfederal information systems. The contractor agrees to ensure that all contractor-owned systems used to store or process data under this agreement comply with all applicable information security directives, acts, laws, regulations, standards, and guidelines. The contractor shall implement any revisions to the requirements described below, within one year of release or other timeframe as indicated by the COR, and at no additional cost to the government. In instances where the contractor finds that security control does not apply, the contractor may request an exception. Any exceptions must be approved in writing by the BLS.

To ensure that security controls for this BLS information system are properly selected, authorized, implemented, and maintained in compliance with Federal requirements, the contractor and all sub- contractors shall comply with DOL and BLS IT security policy and confidentiality and security requirements, per the following documents, OMB memos and federal directives. Aside from NIST 800-53, some documents contain restricted access information that outline the DOL cybersecurity policy, standards, procedures, guidance, and organizationally defined parameters relating to each NIST control family and will made available to the contractor.

Implementation of security controls shall be validated by the COR and NLS ISSO.

A. NIST Special Publication 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations.”

The contractor shall ensure implementation of the respective security controls catalogued in the current version of NIST 800-53 for a “Moderate” baseline system.

These controls shall be subject to assessment and testing guidance provided in NIST Special Publication 800-53A, “Assessing Security and Privacy Controls in Federal Information Systems and Organizations.” Per NIST 800-53A, BLS reserves the right to request the system security plan at any time and any associated plans of action for any planned implementation or mitigations. In instances where the contractor finds that security control does not apply, the contractor may request an exception. Any exceptions must be approved in writing by the BLS.

B. OMB Memo M-22-09 - Moving the U.S. Government Toward Zero Trust Cybersecurity Principles

This memorandum sets forth a Federal zero trust architecture (ZTA) strategy, requiring agencies and their contractors to meet specific cybersecurity standards and objectives by the end of Fiscal Year (FY) 2024 to reinforce the Government’s defenses against increasingly sophisticated and persistent threat campaigns.

Those campaigns target Federal technology infrastructure, threatening public safety and privacy, damaging the American economy, and weakening trust in Government.

The contractor shall ensure implementation of the respective requirements catalogued in OMB M-22-09 including:

• Designating a Zero Trust Strategy implementation lead for the contractor.

BLS will rely on the designated contractor zero trust lead for coordination and for engagement with BLS and DOL on planning and implementation efforts for zero trust requirements.

• Maintain and Implement a Zero Trust implementation plan

The contractor must develop a zero-trust architecture plan that describes how the contractor plans to implement Zero Trust architecture requirements in accordance with OMB Memo M-22-09 for the NLSY27 System.

A zero-trust architecture plan must include the following detailed information:

• Plans to employ centralized identity management systems for agency users that can be integrated into applications and common platforms.

• Plans to require NLS users to use a phishing resistant method to access NLS accounts.

• Plans to incorporate at least one device-level signal alongside identity information about the authenticated user.

• Plans to create ongoing, reliable, and complete asset inventories.

• Plans to use encrypted DNS for the NLSY27 System wherever it is technically supported.

• Plans to enforce authenticated HTTPS for all NLS HTTP traffic, including traffic that does not cross the public internet.

• Plans that describe how the contractor plans to isolate NLS applications and environments through micro segmentation.

• Plans to include application security practices in the System authorization process by employing both automated analysis tools and manual expert analysis to perform security analysis on applications prior to authorization.

C. OMB Memo M-20-32 - Improving Vulnerability Identification, Management, and Remediation

This memorandum provides Federal agencies and their contractors with guidance for obtaining and managing their vulnerability research programs. Implementation will allow for the security research community ("reporters") to report vulnerability information to appropriate contractor contacts, who can then use the reports to mitigate associated risks of which they may not have been aware.

The contractor shall ensure implementation of the respective requirements catalogued in OMB M-20-32 including:

• The contractor shall take affirmative steps to develop a Vulnerability Disclosure

Program (VDP), pursuant to CISA's implementation guidance as a baseline for vulnerability identification, management, and remediation. Beyond these initial actions, the contractor shall work with BLS to improve the maturity, scope, and interconnectivity of their VDPs, and integrate applicable policies and guidance into their overall cybersecurity risk management programs.

• The contractor shall publish and operationalize a VDP within 6 months of the award. Thereafter, the contractor must work with BLS and CISA to continue maturing the processes developed for their VDPs and incorporate their VDP findings and remediation activities into their overall information security program.

• The contractor shall develop implementation plans providing timelines and milestones for VDP to cover all NLSY27 systems.

D. OMB Memo M-21-31 - Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents

This memorandum was developed in accordance with and addresses the requirements in section 8 of the Executive Order for logging, log retention, and log management, with a focus on ensuring centralized access and visibility for the highest-level enterprise security operations center (SOC) of each agency and their contractors. In addition, this memorandum establishes requirements for agencies including contractors to increase the sharing of such information, as needed and appropriate, to accelerate incident response efforts and to enable more effective defense of Federal information and executive branch departments and agencies.

The contractor shall ensure implementation of the respective requirements catalogued in OMB M-21-31 including:

• The contractor, upon award, shall immediately begin efforts to increase performance in accordance with the requirements of OMB 21-31 for Enterprise Logging Maturity. Specifically, the contractor shall assess their maturity against the Enterprise Logging maturity model in memorandum 21-31 and identify resourcing and implementation gaps associated with completing each of the requirements listed below and repot them to BLS.

• The Contractor shall:

o Within 6 months of the award, reach EL1 maturity.

o Within one year of contract award, achieve EL2 maturity.

o Within two years of contract award, achieve EL3 maturity.

o Provide, upon BLS request and to the extent consistent with applicable law, relevant logs to share with the Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI). This sharing of information is critical to defend Federal information systems.

o Share log information, as needed and appropriate, with BLS, DOL, CISA, or FBI to address. cybersecurity risks or incidents.

E. OMB Memo M-22-01 Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response

This memorandum provides implementation guidance to agencies and their contractors as they accelerate the adoption of Endpoint Detection and Response (EDR) solutions and work to improve visibility into and detection of cybersecurity vulnerabilities and threats to the Government, as defined in EO 14028.

The contractor shall ensure implementation of the respective requirements catalogued in OMB M-22-01 including:

• The contractor shall Within 120 days of contract award conduct an analysis, in coordination with BLS, to assess the current status of their EDR capabilities by identifying any gaps in existing EDR deployments and provide a report to BLS including details and status.

• The contractor shall coordinate with BLS for current and future EDR solution deployments to confirm that the solution is approved and aligns with CISA’s technical reference architecture and appropriate data is gathered from the widest number of endpoints.

• The contractor shall provide BLS with visibility upon request into to their current and future EDR solutions to enable proactive threat hunting activities and a coordinated response to advanced threats, and to facilitate, as appropriate, network access for BLS, CISA, or FBI personnel to gain access to contractor EDR platforms if a critical need arises.

• The contractors shall ensure that EDR solutions are implemented with sufficient dedicated resources to support the EDR requirements defined in this section and is operated by staff with training in operating EDR. The contractor shall ensure that endpoint data is consolidated, retained, and archived in a manner that supports analysis and insight, to be defined in the technical reference architecture developed by CISA.

All periodic reports and updates regarding the NLSY27 system are coordinated by BLS staff, but the NLS contractor and its subcontractors are expected to contribute all pertinent information about the security of the NLSY27 system components under the management and control of the contractor or subcontractors. This list is subject to change during the life of the NLS contract depending on any changes to Federal legislation, policies, guidelines, and standards.

The contractor shall update security documents in the event of any major system changes, incident reports, newly discovered vulnerabilities, or weakness mitigations. The contractor shall produce additional security documentation consistent with NIST 800-53 standards upon request by the COR at no additional cost to the government.

Use of Artificial Intelligence (AI)

To ensure consistent and statutorily compliant use of AI technologies (including but not limited to AI models, tools, platforms, systems, or services) throughout the agency, contractors must comply with the following requirements prior to and during use of AI in support of BLS work.

Contractors must:

• Submit proposed AI use cases for approval.

Provide the COR with a written description of all proposed AI technologies and associated use cases prior to implementation. This submission must describe the intended function, data inputs, outputs, IT environment, and impact to operations. The proposal must also demonstrate how bias, quality, accuracy, and trustworthiness of the outputs are addressed or managed.

• Use only approved AI technologies.

Contractors may only use AI technologies that have been approved by the COR. Unauthorized use of AI technologies may not be used for any BLS-related activity.

• Use AI technologies only for approved purposes.

Approved AI technologies must only be used for the specific purposes and use cases authorized by the COR. Any modification, expansion, or new application of the technology requires prior approval.

• Report unauthorized or improper use.

Any unauthorized use of AI technologies, use by unauthorized individuals, or use involving BLS Sensitive Information not previously approved by the COR must be immediately reported to the

COR.

Deliverables 2.2 Compliance with Federal, Department and Agency Policies

The contractor shall provide periodic updates of all security documentation as requested by the COR or

ISSO.

Subtask 2.3 NLSY27 System Assessment and Authorization DOL policies require Assessment and Authorization (A&A) of all information systems that process sensitive information. The A&A process ensures that the system owner documents all of the known security risks inherent in operating a system and obtains approval from the BLS leadership to operate that system with those known risks and any mitigation plans to reduce the risks. DOL developed the A&A policies and procedures to ensure controls are properly implemented and maintained. A federal information system is an information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency.

The Security Controls Assessment (SCA) is conducted every 3 years, at a minimum, as part of the A&A process described above. Staff from BLS or a third-party contractor will assess the managerial, operational, and technical elements, completing a full FISMA audit of all applicable NIST 800-53 controls for a Moderate system. This assessment will involve analysis of the NLSY27 system’s software, hardware, and communication controls. The NLS contractor and subcontractors are expected to cooperate with the SCA team to coordinate interview schedules;

provide applicable documentation or copies; and set up time for observation of applications to demonstrate application functions and controls.

Ongoing Authorization (OA) is the process developed to promote a better understanding of agency- related mission risks resulting from the operation of information systems on a continuous basis. To ensure that proper measures have been taken to secure federal information systems, BLS senior management is required to authorize the processing of each information system prior to placing the system into operational phase. OA is not tied to a termination date but rather remains valid until a significant change occurs altering the risk profile of the system or an event trigger indicates an information security risk above an acceptable level. During the Authorization period, however, additional tasks must be performed to ensure that the conditions underlying the Authorization do not change. These tasks include the continuous monitoring of security controls, regular security assessment, and completion of security documents as required by NLS and its contractor(s) performing these tasks, BLS senior management can maintain reasonable confidence that the information resources are properly protected and are able to meet the mission of the agency.

The NLS contractor is expected to assist BLS staff in preparing documentation for the A&A process. The contractor also is expected to monitor security controls continuously and to assess system security periodically to identify and mitigate risks. The most recent A&A for the NLSY27 system was completed in January 2026. The next reassessment of the NLSY27 system supporting OA will occur in 2028. The contractor shall assist in the assessment process conducted for the NLSY27 system in 2028.

As part of ongoing A&A activities, a Security Self-Assessment (SSA) is conducted annually. The NLS contractor and subcontractors are expected to assess mandatory managerial, operational, and technical elements. The NLS contractor and subcontractors are expected to cooperate with BLS staff to coordinate interview schedules; provide applicable documentation or copies; and set up time for observation of applications to demonstrate application functions and controls. The contractor shall support security inspections conducted by government auditors or other government representatives, as designated by the BLS, at no additional cost. The contractor shall permit security inspections of its approved worksites, system configuration, and operating environment to ensure a secure operation and protection of Federal information processed by any system or operation supporting BLS data collection or processing.

Deliverables 2.3.1 NLSY27 System Assessment supporting Ongoing Authorization The NLSY27 is currently operating under OA. If the NLSY27 does not already have a signed Authority to Operate (ATO), within 12 months of contract award, the contractor based NLSY27 system will undergo the full Assessment by the contractor and Authorization by the BLS Agency Head, who must approve its operation. This must be completed before any data can be placed in the system.

Consistent with OA, if needed because of a major change to the system, the system will be reassessed by the contractor and reauthorized by BLS. After initial authorization assessment, a full NLSY27 System Assessment, supporting Ongoing Authorization, shall be submitted at least every 3 years, or as requested by BLS the contractor will fully assist an outside auditor to complete a full FISMA audit of all applicable NIST 800-53 controls for a Moderate system. A major change to the system may trigger a re-authorization at any time. The contractor shall assist in the assessment’s completion, as well as participate in audits. Note that the scope of a re-assessment and authorization may differ from a full authorization, depending on the nature of the system change.

Deliverable 2.3.2 NLS Partial System NIST Security Self-Assessment (Annual) In a Controls Audit, the contractor will show compliance on a subset of NIST controls selected by the DOL Office of the Chief Information Officer.

for observation of applications to demonstrate application functions and controls.

Deliverable 2.3.3 NLS Independent Full System Audit (every 3 years)

Contractor will fully assist an outside auditor to complete a full FISMA audit of all applicable NIST 800-53 controls for a Moderate system.

Subtask 2.4 Plan of Action and Milestones (Ongoing) The contractor shall document the contractor’s efforts in identifying, assessing, prioritizing, and monitoring the progress of security efforts, vulnerabilities, and corrective actions for fixing or mitigating security weaknesses found in operations, or operating environments of any systems involved in storing, processing, or collecting BLS data. This information should be recorded in the form of a Plan of Action and Milestones (POA&M) and should be updated when a security weakness is found on the NLSY27 system. The POA&M describes a weakness and the steps planned for resolving or mitigating the weakness. Each step also includes a planned completion date. The contractor shall promptly report defects or deficiencies to appropriate supervisory and/or security personnel for follow-up action. For a weakness to be resolved and removed from the POA&M, the NLS program must provide evidence demonstrating the resolution of the weakness.

The POA&M should be accompanied by a security progress report that demonstrates that the contractor has reviewed the audit trail, listed major security issues highlighted in the review of the audit log, and described the contractor’s action(s) on those security issues.

Deliverable 2.4 Plan of Action and Milestones (Ongoing) Templates and instructions for documenting POA&Ms will be provided to the contractor by the NLS ISSO. POA&Ms will be continually monitored, with progress updates required quarterly or as requested by BLS. If there are no POAMS, no reports will be required.

Subtask 2.5 System Security Plan The contractor shall develop and document a formal plan detailing the security policies, procedures, and controls required for any systems involved in storing, processing, or collecting BLS data, as required. The System Security Plan (SSP) shall be completed and submitted to the NLS ISSO within the first quarter following the contract award. The SSP shall be updated annually or upon major changes to the system or system environment. The SSP shall address all management, operational, and technical controls specified in NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems: Minimum Security Controls, Moderate Baseline. The contractor shall implement all security controls as prescribed by NIST and shall report to and seek approval from the BLS for any deviations from NIST 800-53. To provide assurance that the implemented controls are operating as intended, the contractor shall follow NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems.

The purpose of System Security Plan (SSP) is to ensure controls are properly selected, authorized, implemented, and maintained in accordance with NIST standards. The SSP lists all controls for the NLSY27 system and specifies their implementation status.

Deliverable 2.5.1 The System Security Plan The SSP shall be completed and submitted to the NLS ISSO within the first quarter following the contract award. The SSP shall be updated at least annually or upon major changes to the system or system environment and as requested by BLS.

Subtask 2.6 Configuration Management Plan A Configuration Management (CM) plan must be established, documented, maintained, and applied to the NLSY27 system. The appropriate hardware, software, and procedural configuration mechanisms must be defined and developed during the Planning & Requirements Definition Phase of the system development life cycle. The CM plan must be updated and maintained throughout the remaining life cycle phases for the system. The information system personnel and information system must develop a baseline configuration and inventory, control and monitor configuration changes, enforce access restrictions and least functionality, and configure security settings.

The contractor may use a combination of commercially available software and custom developed software established under the secure software development framework defined in NIST SP 800-218. The commercially available software shall have been developed by major software vendors, be widely used, and be actively supported by the developer or other third parties. When selecting among competing commercial off-the-shelf (COTS) software products, the contractor shall choose software and versions that are free from known security vulnerabilities. The chosen COTS software shall reflect the standard commercial practice of industry. The contractor shall consult available security checklists or recommendation guides in selecting secure product configurations and parameter settings. Any custom-developed software shall be developed in compliance with relevant NIST security requirements. After assembling the COTS and custom software elements of the system, the contractor shall undertake a thorough and methodical search for ways by which the security of the integrated system might be undermined. The government has the right to perform a similar analysis. The contractor shall remedy any vulnerability found from the contractor’s review or the government’s review in a timely manner. The contractor will consult with the COR, the NLSY27 System Owner and the NLSY27 ISSO on the usage of software applications.

The standard installation, operation, maintenance, update, and/or patching of software shall not alter the configuration settings from the NIST national checklist program repository (https://nvd.nist.gov/ncp/repository ). Any non-standard configuration settings must be approved by the BLS ISSO.

Applications designed for end users shall run with full functionality in the standard user context without elevated system administration privileges.

Deliverable 2.6 Configuration Management Plan The CM plan must be updated at least annually and updated as needed between annual submissions.

Subtask 2.6Contingency Plan and Testing Contingency planning ensures that an information system can recover from processing disruptions, regardless of the source of the disruption. The contractor shall develop a contingency planning program in accordance with NIST SP 800-34, Contingency Planning Guide for Information Technology Systems.

Contingency planning documentation consists of three deliverables: Contingency Plan (CP), CP Test Report and the Business Impact Analysis.

i. The CP shall include step-by-step procedures to be followed in the case of a major or minor disruption to normal operations. The contractor shall develop a CP that can be used to ensure that any systems involved in storing, processing, or collecting BLS data can continue to operate and perform its function, as needed, during and after any processing disruption, localized emergency, or large-scale disaster. The CP shall provide detailed procedures in the cases for loss of single files, loss of machines, and loss of the entire system.

ii. The CP shall be completed and submitted to the NLS ISSO within the first quarter following the contract award. The CP shall be updated annually or upon major changes to the system or system environment. The CP shall be maintained in a state of current operational readiness to ensure continuity of support if events occur that prohibit normal operations. Current operational readiness means that the contractor shall perform necessary reviews and updates to keep the CP current. The contractor may develop separate documents that, combined, provide the information required in the CP. A hardcopy of the combined and complete CP shall be maintained at both the primary contract site and at an off-site location.

iii. The Contingency Plan contains the NLS program’s detailed plans for responding to an incident that renders an information technology system partially or completely inoperable. The contingency plan is the repository for the NLSY27 system’s business continuity and disaster recovery information, tasks, and procedures to be used when responding to interruptions of normal business operations and services.

iv. Additionally, the contingency plan must be tested and updated annually. Annual reviews must be conducted, and records of these reviews must be included with the Contingency Plan. The contractor shall conduct annual notification tests, and biannual technical and tabletop CP tests as required. The contractor shall analyze test results, report to the NLS ISSO annually on the results of these tests in a CP Test Report, and subsequently modify the CP, as appropriate. The contractor shall present sufficient documentation and evidence of action in the CP Test Report to validate the findings presented. The test report shall include details on what elements of the CP and CP Test Plan did and did not work properly. The CP Testing and Training templates will be provided by the BLS COR.

v. The Business Impact Analysis (BIA) is required at the initiation of the system or if there are significant modifications to the system. It is designed to characterize the system components, supported mission/business processes and functions, and note interdependencies. Based on this information, the agency must characterize the consequences of a disruption or system unavailability. As part of the contingency planning process, a BIA is developed to identify and prioritize system components as they correlate to the mission/business process(s) and essential function(s). The Business Analysis Plan will list system hardware and software, location, quantity, other resources needed to function, and links to other critical system resources.

Deliverable 2.7.1 Business Impact Analysis Updated at least annually, usually in conjunction with the Contingency Plan and updated as needed between annual submissions.

Deliverable 2.7.2 Contingency plan The contractor shall update the contingency plan at least annually and update as needed between annual submissions.

Deliverable 2.7.3 Contingency plan testing The contractor shall complete testing at least annually at BLS direction.

Subtask 2.8 Incident Response Plan The Incident Response (IR) Plan contains detailed information on how security incidents are handled, tracked, monitored, and reported. Annual reviews must be conducted. The contractor shall conduct annual tests as required. The contractor shall analyze test results, report to the NLS ISSO annually on the results of these tests in an IR Test Report, and subsequently modify the IR Plan, as appropriate. The contractor shall present sufficient documentation and evidence of action in the IR Test Report to validate the findings presented. The test report shall include details on what elements of the IR Plan and IR Test Plan did and did not work properly.

Deliverable 2.8.1 Incident Response Plan The contractor shall update the Incident Response Plan at least annually and update as needed between annual submissions.

Deliverable 2.8.1 Incident Response Test Report The contractor shall provide the IR Test Report annually or as requested by the NLS director.

Subtask 2.9 Information Technology Security Requirements for BLS Data and Systems The confidentiality of individually identifiable information contained in project documents, data, and other information supplied by the NLS Program, BLS, DOL, or information acquired in the course of task order must be maintained, secured, and protected from disclosure as provided.

The contractor shall maintain the confidentiality, integrity, and availability of all BLS data and systems and their associated hardware, software, and…