PWS - Task Order 19.pdf

Performance Work Statement Version Date: March 1, 2022

Contract Title: Task 19 Support for Longitudinal Studies Contract Type: Firm Fixed Price

Support for Longitudinal Studies

Performance Work Statement

I. Background and Purpose

This contract provides support for the Longitudinal Surveys Branch (LSB) within the Sample Surveys Division. Among other responsibilities, the Branch is responsible for the design, operation, and on-going support for one repeated cross-sectional study and multiple longitudinal studies that span the life course. To date, these studies include four national early childhood cohort studiesthe Early Childhood Longitudinal Study, Birth Cohort (ECLS-B), the Early Childhood Longitudinal Study, Kindergarten Class of 1998-99 (ECLS-K), the Early Childhood Longitudinal Study, Kindergarten Class of 2010-11 (ECLS-K:2011), and the Early Childhood Longitudinal Study, Kindergarten Class of 2022-24 (ECLS-K:2024); a longitudinal study of students in middle grades (6 and 8) referred to as the Middle Grades Longitudinal Study of 2017- 18 (MGLS:2017); longitudinal studies of high school students dating back to 1972, with the most recent being the High School Longitudinal Study of 2009 (HSLS:09) and the High School and Beyond Longitudinal Study of 2022 (HS&B:22); and several studies at the postsecondary level, including the National Postsecondary Student Aid Study (NPSAS), the Baccalaureate and Beyond Longitudinal Study (B&B), the Beginning Postsecondary Students Longitudinal Study (BPS), and other related data collections including components such as student records from postsecondary institutions, Postsecondary Education Transcript Study (PETS) collections, and other administrative data linkages.

The purpose of this contract is to provide the Branch with support across the full range of design and reporting activities associated with major data collection projects and statistical studies.

Over the life of this contract, the contractor will support work conducted over the lifecycle of the Branch’s studies, including study development and clearance activities; cognitive laboratory work; field test and national data collection activities; review of data files and data documentation; report review and development; and outreach, user support, and training activities. The scope of work, deliverables, and schedule of deliverables are organized around these study needs. The specific work to be done during any given program year is dependent on the specific stage of a study lifecycle that each study will be in during the program year. At the elementary and middle-grade levels, work will focus heavily on the ECLS-K:2024, though the contractor must be familiar with the earlier ECLS collections and the MGLS. The contractor shall also be called upon to provide assistance with review of materials for HS&B:22 and the Branch’s postsecondary studies, though the contractor must be familiar with the earlier Branch studies at these educational levels as well.

II. Period of Performance and Overview of Task Scope

The period of performance for this contract is a base period of 12-month base period.

This project will support work on the large-scale surveys for which the Longitudinal Surveys Branch (LSB) is responsible. Large-scale data collection projects have a number of key activities, and these activities largely determine the types of support needed.

There is a large volume of highly technical work associated with this contract and the work tends to require relatively short development periods. The contractor must understand that there will not be time after the start of the contract for the contractor personnel to familiarize themselves with the content and background of the studies.

Additionally, the contractor must understand that the timeline for work associated with active data collections and for design work is largely determined by a third-party contractor. The contractor offers staff who know the Branch’s studies and are available to review materials at the time they are submitted to NCES. The contractor must understand that to meet tight study deadlines, it is often necessary to provide professional review of study materials in 9 business days or less (for example, the final versions of the hard–copy instruments that will be used to mass produce the instrumentation for data collection). The contractor must also understand that many of the subtasks under this contract build on each other.

A significant amount of work in this contract involves assisting NCES with review of materials produced by the third-party contractors who conduct the study data collections. This review is critical to the production of high-quality materials that adhere to standards and best practices for survey research, measurement, data dissemination, and reporting. ESSIN assistance with review is needed to provide technical expertise that Government staff may not have and due to the volume of work involved in major data collections. ESSIN reviews will be submitted to NCES staff, not the third-party contractors. ESSIN staff will not direct the third-party contractors.

III. Scope of Work

The tasks within this PWS fall into six general areas: management tasks, study development tasks, study operations tasks, data file and documentation review, reporting and analysis support, and training and other outreach.

Task 1 – Weekly project/progress meetings The contractor shall meet with NCES project staff on a weekly basis to keep apprised of study schedules and deliverables for review. Several meetings (up to 8) shall be held each week. The contractor shall use these meetings to share information about the progress of ongoing work. The meetings will also be used to inform the contractor staff about upcoming work NCES anticipates regarding the tasks detailed below. Information shared in these meetings, for example about study design decisions and implementation, shall be needed when reviewing data, technical documentation, and reports produced by third-party contractors. For this reason, the contractor staff shall attend the meeting for the projects on which they have a substantive role. The contractor should expect that meetings for each project will be held virtually or by telephone.

For the ECLS, the contractor staff working on the ECLS project shall attend one virtual or phone meeting of approximately 1 hour each week to discuss ECLS tasks with NCES project staff. The contractor shall provide an updated project schedule and task list within 1 day after each weekly meeting that details work currently being done on the project and includes a summary of work on the horizon (i.e., a “to do list”). The project schedule shall include items related to the ECLS- K:2024 study and any relevant work being done for prior ECLS studies.

For the MGLS:2017, the contractor staff working on the MGLS:2017 project shall attend one meeting of approximately 1 hour each week to discuss MGLS:2017 tasks with NCES project staff. The contractor shall also attend one meeting of approximately 1 hour each week with the MGLS:2017 data collection contractor and NCES project staff. For the MGLS:2017, an agenda shall be provided by NCES in advance of the meeting.

For the high school studies, the contractor shall attend one meeting of approximately 1 hour each week to discuss tasks on these studies with NCES project staff. The contractor staff shall also attend one meeting of approximately 1 hour each week with the HS&B:22 data collection contractor and NCES project staff.

For the postsecondary studies, the contractor shall attend approximately 2 hours of meetings per week. Meetings typically occur as follows:

• Weekly meetings for all studies: Thursdays, 2-3:00pm, unless an alternate date and time is agreed upon by the NCES Task Leader and the contractor.

• Special Topic/Rotating Study Meetings: Tuesdays, 2-3:00pm, unless an alternate date and time is agreed upon by the NCES Task Leader and the contractor.

• Ad hoc meetings as scheduled.

Every 2 weeks, the contractor shall prepare the following for postsecondary meetings with NCES project staff:

• Bi-weekly report on the status of the contractor deliverables to be used to manage and track the deliverables in this work plan, and

• Bi-weekly report on the status of all postsecondary deliverables sorted by date and priority (i.e., items that are on a critical path in the work breakdown structure of a project) with an emphasis on meeting IES targets for data release.

Task 2 –Technical Review Panel and Design Meetings The contractor shall attend virtual meetings such as Technical Review Panels or related virtual meetings with the third-party data collection contractor in order to track study design decisions and implementation.

The contractor shall assume three days of meetings each for two people, which can be split between technical review panels or one-day technical meetings with the third-party data collection contractor. The meetings will focus on the postsecondary studies.

The contractor shall provide NCES with detailed reviews of meeting materials prepared by the third-party contractor. These materials will be distributed to the attendees prior to the meeting.

The contractor shall also provide professional reviews of meeting minutes, summaries, and recommendations from the Technical Review Panel meeting. Original meeting materials will be developed outside of this contract. The contractor shall assume only one round of review of each product.

Task 3 –Review of Office of Management and Budget (OMB) clearance packages A clearance package must be submitted to the OMB for approval to conduct cognitive laboratory work, field tests, and national data collections. The contractor shall assist NCES with review of the OMB clearance packages developed by third-party contractors. Professional review includes consideration of package completeness per OMB directives on requests for clearance of statistical data collection studies. It also includes consideration of how the different elements of the package fit with each other (e.g., the relationship between the burden statement and the sample design), and how they relate to drafts of related materials developed prior to creation of the OMB packages. Packages must be submitted to OMB 6 months in advance of the start of data collection; development of the package occurs in the 3 to 4 months prior to package submission.

A change request must be submitted to OMB when changes to a previously approved clearance request are needed. The change requests must include a cover memo detailing the changes and revised package materials. Review of these change requests includes assuring that changes have been made to the most recently approved package, all changes are documented, and all information in the memo is consistent with the changes made in the revised package materials.

Aside from full package clearance requests, NCES periodically submits generic clearance requests for permission to conduct cognitive laboratory work or pilot tests. Smaller in scope than full packages, these packages detail the work to be included in these small-scale tests. Generic clearances are submitted one month in advance of the start of the testing work. Development of the package occurs in the 2 months prior to package submission.

Sample packages prepared for the postsecondary studies can be found at the following URLs:

• Generic: http://www.reginfo.gov/public/do/PRAViewIC?ref_nbr=201406-1850- 002&icID=218151 or

• Field Test: http://www.reginfo.gov/public/do/PRAViewDocument?ref_nbr=201605- 1850-004

• Full Scale: http://www.reginfo.gov/public/do/PRAViewDocument?ref_nbr=201602- 1850-003

The contractor shall plan for review of the following packages:

Subtask 3a: Review of OMB Clearance Package for Postsecondary Studies (NPSAS:24 Student Field Test Package) (1 draft)

Subtask 3b: Review of OMB change memo for Postsecondary Studies (NPSAS:24 Institution Field Test Package) (1 draft)

Subtask 3c: Review of OMB Clearance Package for Postsecondary Studies (Generic Package) (1 draft) http://www.reginfo.gov/public/do/PRAViewIC?ref_nbr=201406-1850-002&icID=218151 http://www.reginfo.gov/public/do/PRAViewIC?ref_nbr=201406-1850-002&icID=218151

Subtask 3d: Review of OMB Clearance Package for ECLS-K:2024 kindergarten and first grade national data collections (2 drafts of the respondent materials only plus 3 drafts of the full OMB package materials, i.e., including package attachments such as those containing the non-assessment instruments)

Task 4 – Programmed instrument reviews for HS&B:22 First Follow-up Field Test Data Collection The contractor shall assist NCES with review of the programmed instruments for the HS&B:22.

Survey instruments will include student, parent, teacher, counselor, and school administrator.

Original instruments have been developed outside of this contract. One round of review each is anticipated for the deliverables associated with this task.

Task 5– Review of documentation for the MGLS:2017 sixth- and eighth-grade data files The contractor shall assist NCES with review of data documentation developed by a third-party contractor for the MGLS:2017 data file. The materials include a data file user’s manual, a student locating report, and documentation for an item-level data file. The student locating report summarizes student tracking activities and is included in the data file user’s manual. The user’s manual is expected to be similar in content and length as the documentation prepared for the

ECLS-K:2011.

Reviews shall focus on the completeness and accuracy of the data documentation including adherence to NCES and other professional statistical standards.

One round of review of each of these products is expected.

Subtask 5a: Review user’s manual for sixth- and eighth-grade restricted-use data file, including student locating report, for MGLS:2017.

Subtask 5b: Review documentation for item-level data file (e.g., item specifications, file description, etc.) (two rounds of review).

Task 6– Review of MGLS:2017 sixth- and eighth-grade data files The contractor shall assist NCES with review of data release materials for the sixth- and eighth-grade collections of MGLS:2017 that are developed by a third-party contractor. For the sixth-and eighth-grade data, the contractor should assume they shall review one draft of the full research and development restricted-use data file and one draft of an assessment item-level data file. In both instances, it is expected that the one review will be of the final file.

Subtask 6a: Review sixth and eighth-grade restricted-use data for MGLS:2017.

Subtask 6b: Review sixth and eighth-grade item-level assessment data file for MGLS:2017.

Task 7– Review of HSLS:09 postsecondary administrative data restricted-use materials The contractor shall assist NCES with review of data release materials for HSLS:09 postsecondary administrative data (“PEAR”) that are developed by a third-party contractor. The contractor shall assume review of three drafts of a restricted-use data file, two drafts of a

PowerStats file, and two drafts of a supplementary document describing the collection of the administrative data.

Because the data match is limited in scope, the file and manuals are expected to be shorter than is typical for secondary longitudinal studies and, therefore, will require significantly less effort to review.

Task 8 – Review of Interim Data for the Postsecondary Sample Studies Using the postsecondary studies quality control checklist, which will be provided, the contractor shall assist NCES with review of data collected from studies that are in-progress (BPS:20/22) to identify potential problems during data collection or data processing. The contractor shall conduct up to 2 data quality reviews. Data files for these reviews will not have complete documentation or source information and that the focus of the review will be the data and not the quality of the documentation provided. The purpose is to uncover problems in instrument routing or obvious errors occurring in the data collection or data processing. While complete documentation will not be provided for these reviews, the contractor shall assume that the data collection contractor will provide either flow charts or data specifications along with the data.

Task 9– Review of ECLS-K:2024 field staff training materials The contractor shall assist NCES by providing professional review of training materials for the K-1 field test staff (i.e., team leaders and assessors) and national school recruitment staff. The original materials shall be developed under a separate contract. NCES anticipates the need for two reviews of each set of training materials, which are expected to include a training manual and training slides.

Subtask 9a: Review training materials for K-1 field test data collection staff.

Subtask 9b: Review training materials for national data collection school recruiters.

Task 10– Attend and evaluate data collection staff trainings for ECLS-K:2024 The contractor shall attend and evaluate staff trainings for the K-1 data collection staff and for national school recruitment staff. The training will be provided by a third party. The contractor staff assigned to training monitoring shall have experience monitoring field staff training. The contractor staff shall not make suggestions directly to training organizers or instructors during the trainings. The contractor shall provide all reviews, suggestions, or ideas to the Contracting Officer’s Representative and NCES study director. Following the trainings, a sample recruitment/locating training report will be delivered; the contractor shall provide a professional review of both draft 1 and a final draft of this memo.

In August 2022, a 5-day in-person training for K-1 field test data collection staff will be held in Rockville, MD. One day of training will be for team leaders, with the remaining 4 days of training for study assessors. The contractor shall have two project staff members attend team leader training and three project staff members attend each day of study assessor training.

Also in August 2022, a 2-day training for national data collection school recruiters will be held in Rockville, MD. The contractor shall have two project staff members attend the training.

The contractor shall provide brief summaries that include pressing issues within 1 business day of each training. In addition, a complete written summary of the monitoring experience will be provided for each training (i.e., field test team leader training, field test assessor training, and national school recruiter training) within 5 business days of the end of each training.

Subtask 10a: Attend and evaluate in-person training for K-1 field test data collection staff.

Subtask 10b: Attend and evaluate training for national data collection school recruiters.

Task 11 – Assist with monitoring ECLS-K:2024 K-1 field test data collection The contractor shall assist NCES by providing monitoring support for the K-1 field data collection, currently scheduled for August through December of 2022. Monitoring for data collection shall include on-site visits during data collection in schools. All visits shall occur by the end of the period of performance. The contractor shall be in each school for 2 days and will send one staff person to each school selected for monitoring. Monitoring is needed in three schools. The specific location of the schools will not be known until the data collection visits are scheduled, but may be assumed to be at various locations across the U.S. The contractor shall expect that all the observation visits will require overnight travel. For the purposes of pricing, the contractor shall assume one trip will be to a school on the West coast, one will be to a school in the Midwest, and one will be to a school in the Southeast. The contractor shall assume West coast and Midwest schools will require a 3-night stay and travel to the East coast will require a 2-night stay. The contractor shall plan to secure airline tickets at least 2-3 weeks in advance of travel dates in order to secure the most cost-efficient rates. Each trip may be cancelled or require rescheduling on short notice (e.g., if the school needs to reschedule their assessment dates).

Travel and related expenses shall be Cost Reimbursable - with supporting receipts, using government approved per diem rates.

After monitoring of data collection, the contractor shall provide brief summaries that include pressing issues within 1 business day and complete written summaries of the monitoring experience within 3 business days. These summaries should focus on data collector adherence to data collection protocols and success in fielding the different instruments, as well as observations about the effectiveness of the data collection protocols and children’s reactions to the child assessment. The contractor staff shall not make suggestions directly to data collection staff or otherwise interfere with data collection as it is occurring. The contractor shall provide all reviews, suggestions, or ideas to the NCES study director or task leader.

In addition, throughout the field period the contractor shall review the third-party contractor’s weekly production reports for the field test and provide comments on errors and issues as they arise.

Subtask 11a: Monitor ECLS-K:2024 K-1 field test data collection.

Subtask 11b: Evaluation of production progress, including errors and issues.

Task 12 – Review HS&B:22 training materials for base-year full-scale data collection staff The contractor shall assist NCES by providing professional review of training materials for the base-year full-scale data collection. The original materials will be developed under a separate contract. The contractor shall focus on the integration of different data collection procedures, data reporting processes, and data security protocols require a thorough understanding of key design features of the study. Key design features include the data collection instruments and data collection protocols. NCES anticipates the need for two reviews of each set of training materials, which are expected to include a training manual and training slides. In addition, a set of home-study training modules is expected to be produced for in-school data collectors.

Subtask 12a: Review training materials for in-school data collection staff.

Subtask 12b: Review training materials for out-of-school data collection staff.

Task 13 – Attend and evaluate data collection staff trainings for HS&B:22 The contractor shall attend trainings for data collection staff for the base-year full-scale data collection. The training will be provided by a third party.

These trainings will be held as follows:

In-school main study data collection staff: In early August 2022, a 4-day, in-person training for in-school data collection staff. The contractor shall have two project staff members attend each day of training. It is expected that this training will take place in Research Triangle Park, NC.

Out-of-school data collection staff: In late August 2022, a 3-day, in-person training for out-bound calling parent interviewers. The contractor shall have two project staff members attend each day of training. It is expected that this training will take place in Research Triangle Park, NC.

Travel and related expenses shall be Cost Reimbursable - with supporting receipts, using government approved per diem rates.

These trainings may occur in the evenings and/or over a weekend. Contractor staff assigned to such monitoring shall have experience monitoring field staff training. The contractor shall provide reviews of the training that focus on adherence to training protocols described in the training materials and on the quality of the training delivery. The contractor shall not make suggestions directly to training organizers or instructors during the trainings.

The contractor shall provide brief summaries that include pressing issues within 1 business day of each training. In addition, a complete written summary of the monitoring experience will be provided for each training (i.e., field test team leader training, field test assessor training, and national school recruiter training) within 5 business days of the end of each training.

Subtask 13a: Attend and evaluate in-person training for in-school data collection staff

Subtask 13b: Attend and evaluate in-person training for out-of-school data collection staff

Task 14 – Assist with monitoring HS&B:22 national data collection

The contractor shall assist NCES by providing monitoring support for the HS&B:22 base-year full scale data collection, currently scheduled for September 2022 through January 2023.

Monitoring for data collection shall include on-site visits during data collection in schools. All visits shall occur by the end of the period of performance. The contractor shall be in each school for 1 day and shall send one staff person to each school selected for monitoring. Monitoring is needed in three schools. The specific location of the schools will not be known until the data collection visits are scheduled, but may be assumed to be at various locations across the U.S. The contractor shall expect that all the observation visits will require overnight travel. For the purposes of pricing, the contractor shall assume one trip will be to a school on the West coast, one will be to a school in the Midwest, and one will be to a school in the Southeast. The contractor shall assume West coast and Midwest schools will require a 2-night stay and travel to the East coast will require a 1-night stay. The contractor shall plan to secure airline tickets at least 2-3 weeks in advance of travel dates in order to secure the most cost-efficient rates. Each trip may be cancelled or require rescheduling on short notice (e.g., if the school needs to reschedule their assessment dates).

Travel and related expenses shall be Cost Reimbursable - with supporting receipts, using government approved per diem rates.

After monitoring of data collection, the contractor shall provide brief summaries that include pressing issues within 1 business day and complete written summaries of the monitoring experience within 3 business days. These summaries should focus on data collector adherence to data collection protocols and success in fielding the different instruments, as well as observations about the effectiveness of the data collection protocols and children’s reactions to the child assessment. The contractor staff shall not make suggestions directly to data collection staff or otherwise interfere with data collection as it is occurring. The contractor shall provide all reviews, suggestions, or ideas to the NCES study director or task leader.

In addition, throughout the field period the contractor shall review the third-party contractor’s weekly production reports for the field test and provide comments on errors and issues as they arise.

Subtask 14a: Monitor HS&B:22 full-scale data collection.

Subtask 14b: Evaluation of production progress, including errors and issues.

Task 15– Develop a First Findings report for the HSLS:09 postsecondary administrative data release The contractor shall coauthor a First Look report using data from the HSLS:09 postsecondary administrative data match collection ("PEAR”). This report shall serve as the release report for the data and shall be prepared during data review. The work on this report typically includes completing the draft report for Branch/Associate Commissioner (AC) review, revising the report per revisions recommended during branch/AC-level review, and subsequent revisions and responses to reviews at the NCES technical/Chief Statistician, NCES Commissioner, and IES review levels. Each review cycle requires the contractor to formally respond to written recommendations from reviewers at each stage of the review process and to modify the report per agreed upon responses to recommendations. The contractor shall also provide versions of the text, tables, and figures that can be readily converted to HTML format. See http://nces.ed.gov/pubsearch/pubsinfo.asp?pubid=2012049 for an example of a First Findings report.

The contractor shall develop a pdf. version of the final report cleared for release that is 508 compliant for readers who may have various disabilities. The contractor shall also provide versions of the text, tables, and figures that can be readily converted to HTML format.

The contractor shall produce three additional drafts and a final version of the report. These drafts shall be reviewed at the NCES technical review, NCES Commissioner, and IES review levels.

Task 16– Review of plans for inclusion of executive function direct assessments in the

ECLS-K:2024

The contractor shall provide professional review of the third-party contractor’s plans for integrating a direct assessment of executive function into the ECLS-K:2024 kindergarten and first-grade rounds, how field staff will be trained, and how the data will be collected and included in the final data sets. Review of two drafts of the executive function plan memo can be anticipated. The contractor shall assume memos of approximately 10-15 pages in length.

Task 17 – As Needed Analyses and Technical Assistance for LSB K-12 Studies The contractor shall provide analyses and documentation as needed to help address requests for estimates and technical assistance using the ECLS, MGLS, and secondary studies data. NCES needs 4 analyses per month and response to 40 requests for technical assistance per month. The analyses shall be returned to NCES in 2 business days. The technical assistance questions shall be responded to within 1 business day. In most instances, the contractor will develop replies to questions for technical assistance to NCES staff, who will communicate directly with the data users. However, for efficiency, in some instances NCES may request that the contractor staff directly reply to data users. Tables and figures associated with the analyses shall be developed per NCES statistical standards; for tables and figures that shall be publicly released, the contractor shall expect to respond to NCES reviewer comments on these materials as required to make the materials suitable for release. The contractor shall maintain a log of requests with date received, the question asked, and the date a response is provided. The log shall be provided to NCES upon request and shall not include personally identifiable information about the requestor.

The contractor shall not initiate such work without a direct request from COR.

Subtask 17a: Develop new analyses and documentation per request.

Subtask 17b: Respond to technical questions about LSB K-12 data.

Task 18– Government Printing Office (GPO) Printing Reviews for the ECLS-K:2024 Kindergarten and First-Grade Field Test K-1 field test hard-copy non-assessment instruments may be printed by a GPO printer. The contractor shall provide a review of the electronic versions of the instruments in the GPO print package to ensure the materials are the correct final forms; the contractor can expect one review of the electronic files to be submitted to GPO. The contractor shall then provide review of the

GPO (or contractor) printer’s work; the contractor can expect one review of electronic “soft proofs” of each of the materials and one review of produced “hard proofs” of each of the materials. All GPO (or printing contractor) reviews shall be quick turnarounds (24 hours or less).

Subtask 18a: Review GPO print package for non-assessment materials.

Subtask 18b: Review non-assessment materials soft proofs.

Subtask 18c: Review non-assessment materials hard proofs.

Task 19 (Optional)– Transition-out The transition period, would not affect the contract periodicity specified above. A transition period of 2 weeks will be required, with dates to be agreed upon by the government and the contractor. During this transition period, the contractor shall expect to hold meetings of 2 hours per study program (early childhood, middle grades, secondary, and postsecondary) to meet with the NCES study directors and additional contractor staff to discuss the current status of work being conducted for each project. Transition services will also account for the efficient transfer of necessary files to the Government.

IV. Confidentiality, Security, IT & Other Requirements

Overview of IES Confidentiality Statute

Confidentiality of Individuals and Institutions NCES assures participating individuals and institutions that any data collected conforms to the IES standards for protecting the privacy of individuals as required by Section 183 of the Education Sciences Reform Act of 2002 (20 U.S.C. §9543):

“. . . all collection, maintenance, use, and wide dissemination of data by the Institute, including each office, board, committee, and Center of the Institute, will conform with the requirements of section 552A of Title 5, United States Code [which protects the confidentiality rights of individual respondents with regard to the data collected, reported, and published under this title].” (Section 183)

Under the Education Sciences Reform Act of 2002 (ESRA 2002), all individually identifiable information about students, their families, and their schools will remain confidential. To this end, this law requires that no person may:

• Use any individually identifiable information furnished under the provisions of this section for any purpose other than statistical purposes for which it is supplied, except in the case of terrorism;

• Make any publication whereby the data furnished by any particular person under this section can be identified; or

• Permit anyone other than the individuals authorized by the Commissioner to examine individual reports.

Further, individually identifiable information is immune from legal process, and will not, without the consent of the individual concerned, be admitted as evidence or used for any purpose in any action, suit, or other judicial or administrative proceeding, except in the case of terrorism.

Employees, including temporary employees, or other persons who have sworn to observe the limitations imposed by this law, who knowingly publish or communicate any individually identifiable information will be subject to fines of up to $250,000 or up to 5 years in prison, or both (Class E felony).

Protection and Security of Data The confidentiality of individually identifiable information contained in project documents, data, and other information supplied by the National Center for Education Statistics, U.S. Department of Education (the Department) or information acquired in the course of performance under this contract where the information was furnished under the provisions of Section 183 of the Education Sciences Reform Act of 2002 is a material aspect of the contract and must be maintained, secured, and protected from disclosure as provided in Section 183. The Privacy Act of 1974 (5 U.S.C. 552a) also applies.

The contractor shall enforce strict procedures for assuring confidentiality. These procedures will apply to all phases of the project and should include but not be limited to: information used to locate study respondents, data collection in the field, coding and editing phases of data prior to machine processing, safeguarding response documents, and maintenance of any respondent follow-up information. The contractor shall physically separate the identifying data required for any follow-up from data required for research purposes.

The contractor is familiar with and will comply with:

1) The Privacy Act of 1974 (5 U.S.C. 552a),

2) Confidentiality Information Protection and Statistical Efficiency Act (CIPSEA) of 2002

(P.L. 107-347, Title V, Subtitle A, “Confidential Information Protection”),

3) Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. 1232g; 34 CFR Part

99),

4) The Freedom of Information Act (5 U.S.C. 552),

5) Part C of the Education Sciences Reform Act of 2002 (P.L. 107-279),

6) Part E, Section 183 of the Education Sciences Reform Act of 2002 (P.L. 107-279),

7) No Child Left Behind Act (20 U.S.C. 70),

8) USA Patriot Act of 2001 (P.L. 107-56),

9) Office of Management and Budget (OMB) Federal Statistical Confidentiality Order of

1997,

10) OMB Guidance of 7/12/2006 on the Reporting of Incidents Involving Personally

Identifiable Information (M-06-19), http://www.whitehouse.gov/OMB/memoranda/fy2006/mo6-19.pdf ,

11) OMB Guidance of 5/22/2006 on Safeguarding Personally Identifiable Information (M- 06-15) http://www/whitehouse.gov/omb/memoranda/fy2006/m-06-15.pdf,

12) Federal Information Security Management Act (FISMA) of 2002 (P.L. 107-347, Title

III),

13) Any new legislation that impacts the data collection through this contract.

The contractor shall maintain the confidentiality of all documents, data, and other information supplied by NCES/ED or acquired in the course of performance of this contract, except for any documents or other information specifically designated as non-confidential by NCES/ED. The contractor shall take such measures as are necessary to maintain the required security and protection of confidential information (see section Data Security Plan). The contractor is prepared to develop compliance procedures in cooperation with the COR concurrently with the development of the study design.

Data Security Plan

Clearance for Access to Restricted Data The contractor must secure NCES authorization to use restricted-use NCES data necessary to conduct their work. The contractor staff identified to use restricted data will participate in an orientation session and sign an Affidavit of Confidentiality form that includes the same restrictions and penalties that apply to NCES staff should individually identifiable data be disclosed. Because of the special working relationship between the NCES and the contractor, authorization will apply to an entire set of data for the length of the contract. Each contractor employee or subcontractor employee whose work requires access to “personally identifiable information” (hereinafter PII) or unreleased data, and those who will be entering schools for work associated with the studies, will obtain a level 5 or 5C security clearance. The contractor must identify in their proposal the list of persons and/or positions that will require security clearances.

Definition of Personally Identifiable Information and Direct Identifiers The term “personally identifiable information” means any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual. The term “direct identifier” denotes any single datum that alone is deemed sufficient to yield a high risk of disclosure if released, such as social security numbers, full names, or biometric records.

Development of Data Security Plan As necessary, the contractor shall present a detailed security plan that expands upon what was presented in the proposal to the COR for approval. In order to ensure the anonymity of individual respondents, the contractor shall draft and execute this plan in compliance with all relevant laws, regulations, and policies governing the security of data, particularly PII. These include (but are not limited to):

1) Section 183 of the Education Sciences Reform Act of 2002, which states:

(a) IN GENERAL - All collection, maintenance, use, and wide dissemination of data by the Institute, including each office, board, committee, and center of the Institute, will conform with the requirements of section 552a of title 5, United States Code, the confidentiality standards of subsection (c) of this section, and sections 444 and 445 of the General Education Provisions Act (20 U.S.C. 1232g, 1232h).

(b) STUDENT INFORMATION - The Director will ensure that all individually identifiable information about students, their academic achievements, their families, and information with respect to individual schools, will remain confidential in accordance with section 552a of title 5, United States Code, the confidentiality standards of subsection (c) of this section, and sections 444 and 445 of the General Education Provisions Act (20 U.S.C. 1232g, 1232h);

2) The Privacy Act of 1974 (5 U.S.C. 552a);

3) The E-Government Act of 2002 (P.L. 107-347);

4) The relevant sections of Title 34 of the Code of Federal Regulations entitled

“Protection of Human Subjects” (34 CFR 97);

5) The U. S. Department of Education OCIO-1 Handbook for Information Assurance

Security Policy (January 2009);

6) Office of Management and Budget Memorandum M-06-19, “Reporting Incidents

Involving Personally Identifiable Information and Incorporating the Cost of Security in Agency Information Technology Investments”;

7) OMB Guidance of 7/12/2006 on the Reporting of Incidents Involving Personally Identifiable Information (M-06-19).

The data security plan will, at a minimum, cover the following issues: the transfer/transport of PII, maintenance, storage, and use of direct identifiers, replacement of direct identifiers with internal codes, security of master survey files, security and confidentiality training for the contractor staff, and reporting of data security breaches. Hence, the data security plan will be written to place particular emphasis on the following aspects of confidentiality and security:

Guidelines for Transfer of PII As a general principle, the physical and/or electronic transfer of PII (particularly direct identifiers) will be limited to the extent practicable. This limitation includes both internal transfers (e.g., transfer of information between agents of the contractor, including subcontractors and/or field workers) and external transfers (e.g., transfers between the contractor and the agency, or between the contractor and another government agency or private entity assisting in data collection).

When it is necessary for the contractor to transfer PII, such transfer must occur in a manner that maximizes the security of information. The data security plan must describe the likely modes of data transfer and establish the most secure procedures practicable. The most secure method of transferring sensitive information is not necessarily the most efficient or convenient one.

• The preferred means of transferring PII (and particularly direct identifiers) is electronic transfer with 128-bit secure sockets layer (SSL) encryption.

• If electronic PII is transferred via physical media (e.g. a CD-ROM or DVD-ROM is created and sent via courier service or mail), all files on the media will be encrypted (FIPS 140-2 standard) with a strong password (e.g., a random string of letters and numbers) and this password will be sent separately from the data. In addition, no obvious external markings or information identifying the media as containing PII will be written, stamped, or otherwise inscribed on the media or its packing material.

• If paper records or files must be transferred, then the contractor and its agents should hand carry these documents for delivery. Shipping or mailing these kinds of documents should be avoided. The contractor shall clearly state in their data security plan if this requirement cannot be met. The data security plan should describe all transfers of paper records or files and how they will be secured. If these documents must be shipped/mailed, the contractor and its agents should avoid transferring multiple direct identifiers in the same shipment. For example, a mailing containing the names, addresses, and social security numbers of subjects is less secure than two mailings: one shipment with the names and addresses and a second shipment with the social security numbers and no additional information. Alternatively, a partial mailing of data could be followed up with a telephone call (for smaller amounts of PII) which provides the remainder of the data verbally. Any shipment sent must have a tracking number. As above, no obvious external markings or information identifying the mailing as containing PII will be written, stamped, or otherwise inscribed on the packing material.

Maintenance, Storage, and Use of Direct Identifiers Under no circumstances will the contractor release PII to unauthorized individuals. In addition, direct identifiers must be maintained in files which are physically separate from other research data, and which are accessible only to sworn agency and the contractor personnel. Individual direct identifiers used during the course of the project will be associated with data only for statistical purposes such as data gathering, matching new data with old, establishing sample composition, authenticating data collections, editing data based on callbacks, or obtaining missing information.

As a general principal, the number of personnel with access to PII (and particularly direct identifiers) will be restricted to the smallest number as possible.

Replacement of Direct Identifiers with Internal Codes Although direct identifying information is often required in the data collection process, to the extent practicable the contractor shall use internally generated identifying codes to track subjects in data files. Whenever possible, the transfer and storage of files containing multiple direct identifiers should be avoided. If the transfer of direct identifiers is required for statistical purposes such as data matching, the minimum number of direct identifiers needed for successful matching will be used.

Security of Master Survey Files The contractor shall maintain security on the complete set (and deliverable backups) of all master survey files and documentation.

Federal Information Security Modernization Act (FISMA) Requirements

Compliance with ED IT Security Policy

The contractor, and all sub-contractors, will comply with the Department of Education’s IT security policy requirements, specifically those set forth in the ‘Handbook for Information Assurance Security Policy OCIO: 3-112, and relevant portions of the OCIO-01 (which are currently being converted into multiple standard documents and standard-instruction documents) and other applicable procedures and guidance. The contractor, and all sub-contractors, will comply with the OCIO: 03-112, Cyber-Security Policy. The contractor, and all sub-contractors, will further comply with all applicable Federal IT security requirements including, but not limited to, the Federal Information Security Modernization Act (FISMA) of 2014, Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.

"In accord with OMB Memorandum M-17-06, and with the NIST SP 800-44, all publicly accessible Federal websites and web services must have HTTPS enabled, and will only provide service over a secure connection, and e-mail applications must have SMTP enabled.” Also, while the Department currently only requires compliance with the NIST SP 800-53 Rev. 3, long-term, it is best to keep in mind and plan for the eventuality that in September of 2015, the Department will begin to require compliance with the NIST SP 800-53 Rev. 4, which was finalized by the NIST, in 2013. “The contractor shall comply with the most current, finalized version of the NIST

SP 800-53.”

“In accord with OMB Memorandum M-17-06, each agency must use only an approved .gov or .mil domain for its official public-facing websites. The requirement to use only approved government domains does not apply in circumstances where the agency is a user or a customer of a third-party website or service that resides on a non-governmental domain.”

“In accord with OMB Memorandums M-17-06, and M-15-13, and M-08-23, and with Binding Operational Directive (BOD) 18-01, and with the NIST SP 800-52 and with the NIST SP 800- 44, all Federal websites and web services must be accessible through a secure connection (HTTPS only, with HSTS), and e-mail applications must have SMTP enabled. The use of HTTPS is encouraged on intranets, but not explicitly required.” “In accord with OMB Memorandum M-08-23, in order to ensure Domain Name System Security (DNSSEC), all federal websites must be hosted on a *.gov location.”

“In accordance with BOD-18-01:

Web Security: Agencies must ensure all publicly accessible Federal websites and web services provide service through a secure connection (HTTPS-only, with HSTS); SSLv2 and SSLv3 are disabled on web servers, and DES and RC4 ciphers are disabled on web servers; and must provide a list to DHS of agency second-level domains that can be HSTS preloaded, for which HTTPS will be enforced for all subdomains.”

Website Development

“In accord with OMB Memorandum M-17-06, each agency must use only an approved .gov or .mil domain for its official public-facing websites. The requirement to use only approved government domains does not apply in circumstances where the agency is a user or a customer of a third-party website or service that resides on a non-governmental domain.”

In accord with OMB Memorandums M-17-06, and M-15-13, and M-08-23, M-10-23, and with the NIST SP 800-52 and with the NIST SP 800-44, all Federal websites and web services must be accessible through a secure connection (HTTPS only, with HSTS), and e-mail applications must have SMTP enabled. The use of HTTPS is encouraged on intranets, but not explicitly required.

For Public-Facing Websites

• Implement controls to ensure that all publicly accessible externally hosted Department websites and web services only provide service through a secure connection, (such as the Hypertext Transfer Protocol Secure (HTTPS)).

• Implement controls to ensure that all publicly accessible Department websites and web services only provide service through a secure connection, (such as the Hypertext Transfer Protocol Secure (HTTPS)) In accord with…