RCA 5 SOW Career Readiness PBT.pdf

Attachment II Contract Number: TBD

U.S. Department of Justice Statement of Work for Career/Work Readiness Certificate Program (CWRCP) Federal Bureau of Prisons

January 15, 2025

Statement of Work for Career/Work Readiness Certificate Program (CWRCP)

BACKGROUND AND SCOPE

The Federal Bureau of Prisons (FBOP) is an agency of the Department of Justice (DOJ). It consists of 127 identified sites throughout the United States, including Hawaii and Puerto Rico;

6 regional offices, Central Office (headquarters), 2 staff training centers, and 22 Residential Reentry Management offices (previously known as community corrections offices).

The BOP is responsible for the custody and care of over 155,000 adults in custody (AIC’s). A significantly large portion of these individuals will inevitably release back into society. The agency is committed to providing resources to establish a supportive environment promoting their successful reintegration into the community after completing their sentences.

The mission of the Bureau Education Branch is to provide mandatory literacy programs, as required by Federal law and rules language, which meet the needs and interests of the AIC’s, provide options for the positive use of their time while incarcerated, and enhance successful reintegration into the community. The Bureau also facilitates post-secondary education, vocational training, and various programs to address needs related to substance abuse, deficits in education, employment and more, that contribute to criminal behavior thereby ensuring their successful transition to the community.

In 2016, the U.S. Sentencing Commission found that only 34% of the individuals released from the Bureau of Prisons in 2005 were rearrested or had their supervision revoked over a three-year period. This figure reflected a 16% decline over the past couple of decades and was half the rate of many large state Departments of Corrections as reported by the Bureau of Justice Statistics. The FBOP is committed to enhancing public safety by reducing recidivism through educational programs. On a typical day, approximately 36% of the AIC’s are participating in one or more educational programs. Programs serve an important role in enhancing the AIC’s potential for success after their release to the community.

The FBOP also recognizes that a High School Equivalency (HSE) credential alone may not be enough to secure employer confidence in basic work skills for those reentering society after incarceration. The ability to obtain sustainable wages is a major factor in combating the recidivism rates for formerly incarcerated individuals. It is increasingly more evident, especially as the number of states implementing workforce readiness education into secondary and post-secondary education continue to increase. Basic skills will not be enough to keep pace with the current and projected workforce needs, thus requiring an alignment with higher standards and high-quality assessments of workplace skills to ensure employer confidence.

PURPOSE

The FBOP intends to make a single award to an entity that will be responsible for providing an evidence-based Career/Work Readiness Certificate Program (CWRCP) to the FBOP. The certificate program must include a curriculum designed for adult learners to identify and develop key competencies and abilities for entry into the workforce and provide a portable credential certifying those skills at the appropriate levels. Delivery of services and test administration must be classroom and paper based. The contract will be paper-based testing (PBT) and classroom related services for the performance period specified.

The vendor must clearly demonstrate evidence-based jobs skills and their alignment with employer needs. The product shall be aligned with the College and Career Readiness Standards supported by the United States Department of Education (DOE). This product shall also support the performance and accountability requirements of the Workforce Innovation and Opportunity Act (WIOA). Upon completing the CWRCP curriculum, students shall be able to demonstrate fundamental to advanced level employability skills, and ultimately be prepared to take and pass a multi-level skills assessment culminating in a portable employer recognized certificate.

The curriculum must have measurable work objectives and goals, as well as clear criteria, which establishes minimum expectations for program completion and assessment of student progress. The product must also successfully provide a comprehensive student progress and skills analysis report. Keeping in mind that this product will service various levels of adult learning skills, the product should support the Universal Design for Learning (UDL) approach.

The product must be available in both English and Spanish.

Additionally, the vendor must provide printed textbooks, workbooks, test materials, teacher resources and guides, and printable curriculum. The vendor shall also provide institutional training for instructional staff on the correct service delivery and administration of the product.

All materials must provide adaptations for individuals with learning disabilities. The product may need to be streamlined for facilitation in a correctional environment.

The following BOP Program Statements, which are available electronically at http://www.bop.gov/, are applicable to this contract.

1. Program Statement 5300.21 – Education, Training, and Leisure Time Program Standards.

2. Program Statement 5310.15 – Minimum Standards for Administration, Interpretation, and Use of Education Tests

References The vendor shall provide a list of correctional agencies utilizing this program and report the number of certificates and level certifications awarded.

Content – Curriculum and Assessments

● The curriculum shall contain evidence based instructional modules which develop the cognitive and soft skills required for formative assessments addressing the needs and demands most required by employers:

o Math/Technical Skills o Literacy/Reading o Communication – Verbal and non-Verbal o And other desirable workplace and/or soft skills

● Instructional modules and materials must be available in both English and Spanish.

● A printed and digital copy of the curriculum shall be provided to each institution.

● The curriculum must have measurable work objectives and goals.

● Pre and Post tests at each level shall be available to measure progress.

● Must contain clear criteria which establishes minimum expectations for completion (as well as minimum expectations/grade level performance for program entry) of formative assessments at various achievement levels, ranging from basic skill levels to highest.

● Student progress and skills analysis reports shall be available for students and CTE instructors (printable) indicating skill gaps and remediation needs.

● The product shall take the Universal Design for Learning (UDL) approach to address the various learners in a correctional environment and may need adaptations to address the needs of that population and those with disabilities and/or special learning needs.

Section 508 compliant where applicable. The vendor shall ensure a method of providing testing accommodations for those in custody with special learning, physical, and psychological needs/disabilities. As directed by the Contracting Officer’s Representative (COR), the contractor shall provide special test editions such as large print, Braille, audiocassettes, or other reasonable accommodations.

● The program and assessments must be deliverable in both the English and Spanish language. Additional languages would be desirable but not mandatory.

● The vendor must provide each student a portable credential, recognized by employers, certifying the assessment and correlation to the achieved skill levels.

● Textbooks/Workbooks, test materials and assessments, instructional resources/guides shall be provided for each facility.

● A printed and digital copy of all deliverables shall be provided to the Central Office

Education Branch.

Management Accessibility:

● The vendor shall provide examiner policy and procedure manuals, training materials, and other necessary materials (hard copies or via electronic) with copyright permission for use at all FBOP institutions as these manuals and materials become available.

● The credential and assessment reports shall be accessible to students after release from FBOP custody for presentation to potential employers and/or other interested parties.

● The vendor shall establish a method of accessing student information during demographic changes within the FBOP and upon the student’s reentry to society.

● The vendor shall provide scoring services for all skill assessments. Scoring must be processed within (7) business day after receipt of answer sheets and related documents. The vendor shall mail two copies of each student score report, certification credentials for each student, if applicable, and site reports via United States Postal Service mail to the FBOP assessment site within (10) days after receipt of the student assessments. There should be group reporting available for FBOP administrators:

o Students tested by facility with sort capabilities of scores, levels, skills assessed, and certificates issued.

o As directed by the COR, the vendor shall provide reports from all FBOP institutions for monthly, quarterly, and/or FBOP fiscal year reporting as needed.

▪ Statistical reports may include the number of students passing specific levels and students who failed assessments.

▪ The statistical reports shall also include percentage data by institutions, regions, age, and other demographic and activity reports as directed by the COR.

▪ All statistical reports should be available electronically which allows for the FBOP to conduct further analyses and disseminate the information to the field and regional locations.

● Due to the diverse AIC population, many AIC’s will not release to the same state in which they were incarcerated. Those in custody may also begin the program or take tests at one institution and transfer to another prior to completion. There must be an available standard process to continue the program at a new location and a process for the vendor to track and combine the student scores.

The maximum quantity for skill assessments, test administrations, and related supplies allocated for a performance period will be listed in task order(s). However, the contractor will be paid based on the actual number of assessments administered, supplies, and reports used in each quarter.

Test and Data Integrity:

● Due to security concerns, all assessment records and related information of the Federal inmates are the property of the FBOP and the individual student and will be treated as confidential information. No records of Federal inmates will be shared with any other entity, agency, or the public without written consent by the FBOP COR or the FBOP AIC.

● The scoring and reporting system shall comply with the USDOJ and the FBOP information security requirements.

● The vendor must provide written assurances of administration and testing integrity and security protocols for skills assessments and student data.

● The vendor shall provide assurances of employer recognition and portability of credentials.

● The FBOP test site administrators shall be responsible for establishing testing schedules, as well as approving FBOP students for level tests using the assessment guidelines established by the vendor.

Compliance with Information Technology Security Policies, Procedures and Requirements

A. For all Covered Information Systems, Contractor shall comply with all security requirements, including but not limited to the regulations and guidance found in the Federal Information Security Management Act of2014 ("FISMA"), Privacy Act of 1974, E-Government Act of 2002, National Institute of Standards and Technology ("NIST") Special Publications ("SP"), including NIST SP 800-37, 800-53, and 800-60 Volumes I and II, Federal Information Processing Standards ("FIPS") Publications 140-2, 199, and 200, 0MB Memoranda, Federal Risk and Authorization Management Program ("FedRAMP"), DOJ IT Security Standards, including DOJ Order 2640.2, as amended. These requirements include but are not limited to:

1. Limiting access to DOJ Information and Covered Information Systems to authorized users and to transactions and functions that authorized users are permitted to exercise;

2. Providing security awareness training including, but not limited to, recognizing and reporting potential indicators of insider threats to users and managers of DOJ Information and Covered Information Systems;

3. Creating, protecting, and retaining Covered Information System audit records, reports, and supporting documentation to enable reviewing, monitoring, analysis, investigation, reconstruction, and reporting of unlawful, unauthorized, or inappropriate activity related to such Covered Information Systems and/or DOJ Information;

4. Maintaining authorizations to operate any Covered Information System;

5. Performing continuous monitoring on all Covered Information Systems;

6. Establishing and maintaining baseline configurations and inventories of Covered

Information Systems, including hardware, software, firmware, and documentation, throughout the Information System Development Lifecycle, and establishing and enforcing security configuration settings for IT products employed in Information Systems;

7. Ensuring appropriate contingency planning has been performed, including DOJ Information and Covered Information System backups;

8. Identifying Covered Information System users, processes acting on behalf of users, or devices, and authenticating and verifying the identities of such users, processes, or devices, using multifactor authentication or HSPD-12 compliant authentication methods where required;

9. Establishing an operational incident handling capability for Covered Information Systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities, and tracking, documenting, and reporting incidents to appropriate officials and authorities within Contractor's organization and the DOJ;

10. Performing periodic and timely maintenance on Covered Information Systems, and providing effective controls on tools, techniques, mechanisms, and personnel used to conduct such maintenance;

11. Protecting Covered Information System media containing DOJ Information, including paper, digital and electronic media; limiting access to DOJ Information to authorized users; and sanitizing or destroying Covered Information System media containing DOJ Information before disposal, release or reuse of such media;

12. Limiting physical access to Covered Information Systems, equipment, and physical facilities housing such Covered Information Systems to authorized U.S. citizens unless a waiver has been granted by the Contracting Officer ("CO"), and protecting the physical facilities and support infrastructure for such Information Systems;

13. Screening individuals prior to authorizing access to Covered Information Systems to ensure compliance with DOJ Security standards;

14. Assessing the risk to DOJ Information in Covered Information Systems periodically, including scanning for vulnerabilities and remediating such vulnerabilities in accordance with DOJ policy and ensuring the timely removal of assets no longer supported by the Contractor;

15. Assessing the security controls of Covered Information Systems periodically to determine if the controls are effective in their application, developing and implementing plans of action designed to correct deficiencies and eliminate or reduce vulnerabilities in such Information Systems, and monitoring security controls on an ongoing basis to ensure the continued effectiveness of the controls;

16. Monitoring, controlling, and protecting information transmitted or received by Covered Information Systems at the external boundaries and key internal boundaries of such Information Systems, and employing architectural designs, software development techniques, and systems engineering principles that promote effective security; and

17. Identifying, reporting, and correcting Covered Information System security flaws in a timely manner, providing protection from malicious code at appropriate locations, monitoring security alerts and advisories and taking appropriate action in response.

B. Contractor shall not process, store, or transmit DOJ Information using a Covered Information System without first obtaining an Authority to Operate ("ATO") for each Covered Information System. The ATO shall be signed by the Authorizing Official for the DOJ component responsible for maintaining the security, confidentiality, integrity, and availability of the DOJ Information under this contract. The DOJ standards and requirements for obtaining an ATO may be found at DOJ Order 2640.2, as amended.

(For Cloud Computing Systems, see Section V, below.)

C. Contractor shall ensure that no Non-U.S. citizen accesses or assists in the development, operation, management, or maintenance of any DOJ Information System, unless a waiver has been granted by the by the DOJ Component Head (or his or her designee) responsible for the DOJ Information System, the DOJ Chief lnformation Officer, and the DOJ Security Officer.

D. When requested by the DOJ CO or COR, or other DOJ official as described below, in connection with DOJ's efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of DOJ Information, Contractor shall provide DOJ, including the Office of lnspector General ("OIG") and Federal law enforcement components, (1) access to any and all information and records, including electronic information, regarding a Covered Information System, and (2) physical access to Contractor's facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by DOJ or agents acting on behalf of DOJ, and such access shall be provided within 72 hours of the request. Additionally, Contractor shall cooperate with DOJ's efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of DOJ Information.

E. The use of Contractor-owned laptops or other portable digital or electronic media to process or store DOJ Information covered by this clause is prohibited until Contractor provides a letter to the DOJ CO, and obtains the CO's approval, certifying compliance with the following requirements:

1. Media must be encrypted using a NIST FIPS 140-2 approved product;

2. Contractor must develop and implement a process to ensure that security and other applications software is kept up-to-date;

3. Where applicable, media must utilize antivirus software and a host-based firewall mechanism;

4. Contractor must log all computer-readable data extracts from databases holding

DOJ Information and verify that each extract including such data has been erased within 90 days of extraction or that its use is still required. All DOJ Information is sensitive information unless specifically designated as non-sensitive by the DOJ;

and,

5. A Rules of Behavior ("ROB") form must be signed by users. These rules must address, at a minimum, authorized and official use, prohibition against unauthorized users and use, and the protection of DOJ Information. The form also must notify the user that he or she has no reasonable expectation of privacy regarding any communications transmitted through or data stored on Contractor-owned laptops or other portable digital or electronic media.

F. Contractor-owned removable media containing DOJ Information shall not be removed from DOJ facilities without prior approval of the DOJ CO or COR.

G. When no longer needed, all media must be processed (sanitized, degaussed, or destroyed) in accordance with DOJ security requirements.

H. Contractor must keep an accurate inventory of digital or electronic media used in the performance of DOJ contracts.

I. Contractor must remove all DOJ Information from Contractor media and return all such information to the DOJ within 15 days of the expiration or termination of the contract, unless otherwise extended by the CO, or waived (in part or whole) by the CO, and all such information shall be returned to the DOJ in a format and form acceptable to the DOJ. The removal and return of all DOJ Information must be accomplished in accordance with DOJ IT Security Standard requirements, and an official of the

Contractor shall provide a written certification certifying the removal and return of all such information to the CO within 15 days of the removal and return of all DOJ Information.

J. DOJ, at its discretion, may suspend Contractor's access to any DOJ Information, or terminate the contract, when DOJ suspects that Contractor has failed to comply with any security requirement, or in the event of an Information System Security Incident (see Section V.E. below), where the Department determines that either event gives cause for such action. The suspension of access to DOJ Information may last until such time as DOJ, in its sole discretion, determines that the situation giving rise to such action has been corrected or no longer exists. Contractor understands that any suspension or termination in accordance with this provision shall be at no cost to the DOJ, and that upon request by the CO, Contractor must immediately return all DOJ Information to DOJ, as well as any media upon which DOJ Information resides, at Contractor's expense.

Cloud Computing A. Cloud Computing means an Information System having the essential characteristics described in NIST SP 800-145, The NIST Definition of Cloud Computing. For the sake of this provision and clause, Cloud Computing includes Software as a Service, Platform as a Service, and Infrastructure as a Service, and deployment in a Private Cloud, Community Cloud, Public Cloud, or Hybrid Cloud.

B. Contractor may not utilize the Cloud system of any CSP unless:

1. The Cloud system and CSP have been evaluated and approved by a 3PAO certified under FedRAMP and Contractor has provided the most current Security Assessment Report (“SAR”) to the DOJ CO for consideration as part of Contractor’s overall System Security Plan, and any subsequent SARs within 30 days of issuance, and has received an ATO from the Authorizing Official for the DOJ component responsible for maintaining the security confidentiality, integrity, and availability of the DOJ Information under contract; or,

2. If not certified under FedRAMP, the Cloud System and CSP have received an ATO signed by the Authorizing Official for the DOJ component responsible for maintaining the security, confidentiality, integrity, and availability of the DOJ Information under the contract.

C. Contractor must ensure that the CSP allows DOJ to access and retrieve any DOJ Information processed, stored or transmitted in a Cloud system under this Contract within a reasonable time of any such request, but in no event less than 48 hours from the request. To ensure that the DOJ can fully and appropriately search and retrieve DOJ Information from the Cloud system, access shall include any schemas, meta-data, and other associated data artifacts.

Information System Security Breach or Incident:

A. Definitions

1. Confirmed Security Breach (hereinafter, "Confirmed Breach") means any confirmed unauthorized exposure, loss of control, compromise, exfiltration, manipulation, disclosure, acquisition, or accessing of any Covered Information System or any DOJ Information accessed by, retrievable from, processed by, stored on, or transmitted within, to or from any such system.

2. Potential Security Breach (hereinafter, "Potential Breach") means any suspected, but unconfirmed, Covered Information System Security Breach.

3. Security Incident means any Confirmed or Potential Covered Information System Security Breach.

B. Confirmed Breach. Contractor shall immediately (and in no event later than within 1 hour of discovery) report any Confirmed Breach to the DOJ CO and the CO's Representative ("COR"). If the Confirmed Breach occurs outside of regular business hours and/or neither the DOJ CO nor the COR can be reached, Contractor must call DOJ-CERT at l-866-US4-CERT (1-866-874-2378) immediately (and in no event later than within 1 hour of discovery of the Confirmed Breach), and shall notify the CO and COR as soon as practicable.

C. Potential Breach.

1. Contractor shall report any Potential Breach within 72 hours of detection to the

DOJ CO and the COR, unless Contractor has (a) completed its investigation of the Potential Breach in accordance with its own internal policies and procedures for identification, investigation and mitigation of Security Incidents and (b) determined that there has been no Confirmed Breach.

2. If Contractor has not made a determination within 72 hours of detection of the Potential Breach whether an Confirmed Breach has occurred, Contractor shall report the Potential Breach to the DOJ CO and COR within one-hour (i.e., 73 hours from detection of the Potential Breach). If the time by which to report the Potential Breach occurs outside of regular business hours and/or neither the DOJ CO nor the COR can be reached, Contractor must call the DOJ Computer Emergency Readiness Team (DOJ-CERT) at l-866-US4-CERT (1-866-874-2378) within one-hour (i.e., 73 hours from detection of the Potential Breach) and contact the DOJ CO and COR as soon as practicable.

D. Any report submitted in accordance with paragraphs (B) and (C), above, shall identify

(1) both the Information Systems and DOJ Information involved or at risk, including the type, amount, and level of sensitivity of the DOJ Information and, if the DOJ

Information contains PII, the estimated number of unique instances of PII, (2) all steps and processes being undertaken by Contractor to minimize, remedy, and/or investigate the Security Incident, (3) any and all other information as required by the US-CERT Federal Incident Notification Guidelines, including the functional impact, information impact, impact to recoverability, threat vector, mitigation details, and all available incident details; and (4) any other information specifically requested by the DOJ.

Contractor shall continue to provide written updates to the DOJ CO regarding the status of the Security Incident at least every three (3) calendar days until informed otherwise by the DOJ CO.

E. All determinations regarding whether and when to notify individuals and/or federal agencies potentially affected by a Security Incident will be made by DOJ senior officials or the DOJ Core Management Team at DOJ's discretion.

F. Upon notification of a Security Incident in accordance with this section, Contractor must provide to DOJ full access to any affected or potentially affected facility and/or Information System, including access by the DOJ OIG and Federal law enforcement organizations, and undertake any and all response actions DOJ determines are required to ensure the protection of DOJ Information, including providing all requested images, log files, and event information to facilitate rapid resolution of any Security Incident.

G. DOJ, at its sole discretion, may obtain, and Contractor will permit, the assistance of other federal agencies and/or third-party contractors or firms to aid in response activities related to any Security Incident. Additionally, DOJ, at its sole discretion, may require Contractor to retain, at Contractor's expense, a Third-Party Assessing Organization (3PAO), acceptable to DOJ, with expertise in incident response, compromise assessment, and federal security control requirements, to conduct a thorough vulnerability and security assessment of all affected Information Systems.

H. Response activities related to any Security Incident undertaken by DOJ, including activities undertaken by Contractor, other federal agencies, and any third-party contractors or firms at the request or direction of DOJ, may include inspections, investigations, forensic reviews, data analyses and processing, and final determinations of responsibility for the Security Incident and/or liability for any additional response activities. Contractor shall be responsible for all costs and related resource allocations required for all such response activities related to any Security Incident, including the cost of any penetration testing.

Personally Identifiable Information Notification Requirement

Contractor certifies that it has a security policy in place that contains procedures to promptly notify any individual whose Personally Identifiable Information ("PII") was, or is reasonably determined by DOJ to have been, compromised. Any notification shall be coordinated with the DOJ CO and shall not proceed until the DOJ has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by Contractor shall be coordinated with, and subject to the approval of, DOJ. Contractor shall be responsible for taking corrective action consistent with DOJ Data Breach Notification Procedures and as directed by the DOJ CO, including all costs and expenses associated with such corrective action, which may include providing credit monitoring to any individuals whose PII was actually or potentially compromised.

Pass-through of Security Requirements to Subcontractors and CSP’s:

The requirements set forth in the preceding paragraphs of this clause apply to all subcontractors and CSPs who perform work in connection with this Contract, including any CSP providing services for any other CSP under this Contract, and Contractor shall flow down this clause to all subcontractors and CSPs performing under this contract. Any breach by any subcontractor or CSP of any of the provisions set forth in this clause will be attributed to Contractor.

Period of Performance

The period of performance shall be for one (1) Fiscal Year of 12 months for the system and technical support.

The BOP anticipates the overall engagement of this contract to begin in Fiscal Year 2026, with work as to the core LMS functions to be completed no later than one year from the award of the contract for the test sites. Upon the award of contract, the Contracting Officer will host a mandatory kick-off meeting for initial introductions for involved parties. This meeting may be held in person, or via video/teleconference.

SUPPORT/TRAINING

● The vendor shall dedicate a resource staff specifically to address all issues associated with the administration of the CWRCP. This support will include, but is not limited to, site administrator and user account support and troubleshooting for institutions and released inmates, data reporting and material requests/purchasing. Additionally, the identified resource staff shall address contract administration and any issue or concerns on the program administration with the COR.

● The vendor shall provide training options to FBOP staff on the service delivery and test administration for all forms of the product via mutually agreed upon intervals and modes to include, but not limited to, on-site by vendor training (Train the Trainer), printed manuals, remote/webinar, and/or online training if accessible. The vendor shall work collaboratively with FBOP Central Office Education branch to define the ongoing training solution.

● Training dates will be mutually agreed upon between the vendor and FBOP. The vendor shall provide limited on-site training. All vendor training travel cost will be borne by the vendor.

● The vendor shall provide institutions with content support via portal, email, chat, and phone support Monday – Friday from 8:00 am – 10:00 pm EST and Saturday from 8:00 am – 7:00 pm EST.

● The vendor shall provide updates to materials/resources when made available through the publisher.

● The vendor shall provide, on a quarterly basis, by the 25th day after the end of each quarter, an itemized invoice sent via e-mail to the FBOP Central Office Business office and the COR.