RFI Attachment 2 - Potential NGC Minimum Information Technology (IT) Contract Requirements (MITCR).docx

Minimum IT Contract Requirements – DME and O&M Selected Acronyms and Abbreviations

FSA Minimum Information Technology Contract Requirements for FSA NGC

FSA Minimum IT Contract Requirements for FSA NGC FSA System Development Lifecycle (SDLC) The Contractor shall comply with the Federal Student Aid (FSA) System Development Lifecycle (FSA-SDLC), currently named the Lifecycle Management Methodology (LMM), during the term of this contract.

https://studentaid.gov/about/contracting-info/it-standards FSA Software Development Approach For software development activities: software development approach must result in a low-risk and compliant development process. Any proposed solution must leverage technologies currently approved by FSA. The solution should use automation to accelerate testing. A large portion of FSA’s existing development, security and operations (DevSecOps) pipelines is in the Amazon Web Services (AWS) environment.

Any proposed solution shall utilize the products approved in FSA’s Technology Standards and Product Guide (TSPG), which is published at the following URL:

https://studentaid.gov/sites/default/files/fsawg/static/gw/docs/ciolibrary/Technology_Standards_and_Products_Guide.pdf Any new technology or product proposed by the contractor, must be approved via FSA’s Approval and Board Process. Without approval, products listed in the TSPG shall be used.

FSA Software Platform For system and software platform: Any proposed solution must be developed with portability and severability in mind. This is to accommodate an eventual migration to a unified cloud platform that Federal Student Aid is currently visioning and building. As an interim strategy, it is preferred that the solution be positioned as an application tenant in one of two existing platforms in use by Federal Student Aid. If the solution is positioned in another platform (not one of the existing platforms) it is expected that the solution will be portable to the future unified cloud platform that Federal Student Aid is currently visioning and building. All the application related core functionality should be derived from the platform. These functions include but are not limited to: Logging, monitoring, security scanning, Identity & Access Management (IDAM), Security information and event management (SIEM), version Control, Continuous Integration/Continuous Deployment (CI/CD) pipeline, build management, Artifact and Configuration management, test automation, telecom, virtual private network (VPN) and firewalls.

FSA Cloud Architecture Applications shall be portable and severable to FSA’s targeted cloud platform. If the contractor intends to stand up their own cloud solution platform, then the contractor must support a multi-tenant-multi-vendor posture on their platform; if they do not, then they will need to host their application tenant within the most suitable existing platform (e.g., NGDC cloud, FSA Cloud).

Collaboration Requirement In carrying out the scope of work under this contract, the contractor shall collaborate and share technical information with FSA and other contractor support staff in the holistic delivery of solutions, services, and results to FSA. This collaboration may be required in specific situations at the direction of the Contracting Officer (CO) or as may be delegated to the Contracting Officer’s Representative (COR).

Transition Support Transition Support Instructions To ensure a smooth transition, and support of such continuity of service requirements as may be stipulated in the contract; the contractor shall submit a Phase-In Plan as a part of its technical proposal. This plan will be used as a basis of negotiation by the successor contractor and transition with the incumbent contractor. The government will provide existing contract phase-out plans, if available, to the proposing contractors to assist their efforts.

The Contractor shall also establish and implement plans for an orderly phase-out of the contracted operations at the termination of this Contract. The Contractor shall submit a Phase-out Plan to the CO for evaluation and approval six-months after contract start. The Contractor's phase-out procedures shall not disrupt or adversely impact the day-to-day conduct of Government business. The Contractor shall maintain the plan as contract changes are made and provide the CO with the copies of changes and revisions for review and approval prior to implementation. The contractor will use this plan to ensure the smooth transition of services to a successor contractor in accordance with Federal Acquisition Regulation (FAR) 52.237-3, Continuity of Services.

Transition Support (Phase-In) The Contractor shall develop comprehensive procedures for phasing in contractor performance to the level prescribed and within the time allowed under the terms of this contract.

The period between Contract award date and Contract start date will constitute the phase-in period. During the phase-in period, the Contractor shall prepare to assume full responsibility for all areas of operation in accordance with the terms and conditions of this contract. The Contractor shall take all actions necessary for a smooth transition of the contracted operations.

The contractor shall propose their phase-in period, not to exceed three months. The Government will make all facilities and equipment accessible to the Contractor during the phase-in period. During the last 60 days of the phase-in period, the Contractor's management personnel will be permitted to observe any on-going operations, as approved by the CO.

During the phase-in period, the Contractor shall ensure it is ready to fully perform the contract without assistance from the incumbent or Government by the contract start date. Phase In tasks include but are not limited to:

Establish a Contractor’s Project Management Office to coordinate phase-in tasks and to be the single point of contact for the Government during the phase-in.

Recruit and hire necessary personnel.

Obtain all required certifications and clearances, including personnel security clearances. For access to any Federal Student Aid facility, system, and/or data, all contractor personnel shall be required to obtain the necessary security clearance in accordance with the U.S. Department of Education personnel security policy and Federal Student Aid IT Security & Privacy Policy.

Participate in development of joint inventories and sign for Government furnished property/equipment/information.

Develop and submit any required deliverables.

Attend post-award meetings as required.

Accomplish necessary training to support the operations and maintenance functions.

Transition Support (Phase-Out) The Contractor shall develop a Phase-Out Plan to affect a smooth and orderly transfer of contract responsibility to a successor. The plan shall fully describe how the Contractor shall, at a minimum, approach the following issues: employee notification; retention of key personnel; turn-over of work-in-progress, inventories, and Government property; removal of Contractor property; data and information transfer; and any other actions required to ensure continuity of operations.

The Contractor’s Phase-Out Plan shall, at a minimum, require that the incumbent and the Government conduct an inventory before the conduct of a joint inventory between the incumbent and the successor Contractor. The Plan shall, at a minimum, also include: reconciliation of all property accounts, requisitions, and work-in-progress; turn-in of excess property; Contractor work areas’ clean-up; plan for training successor contractor, specialized equipment, utilities systems, and ongoing work that the successor would be required to complete; and security debriefings in accordance with FSA security procedures for incumbent personnel holding security clearances.

For a period of sixty (60) calendar days, starting anywhere from 60 days prior to the completion of this contract to 90 days after the contract expires (as directed by the Contracting Officer in accordance with 52.237-3, Continuity of Services, an observation period shall occur, at which time management personnel of the incoming workforce may observe operations and performance methods of the incumbent contractor. This will allow for orderly turnover of facilities, equipment, and records and will help to ensure continuity of service. The Contractor shall not defer any requirements for the purpose of avoiding responsibility or of transferring such responsibility to the succeeding contractor. The Contractor shall fully cooperate with the succeeding contractor and the Government so as not to interfere with their work or duties.

Personally Identifiable Information The contractor shall secure, protect, deliver, and not release any data containing Personally Identifiable Information (PII) regardless of form or media, consistent with FAR clause 52.227-17.

Intellectual Property All deliverables not containing PII shall be delivered with unlimited rights, as defined by FAR clause 52.227-14.

Software Licensing

TBD

FSA Branding FSA requires that both public-facing and internal products follow the FSA Brand Style guide and FSA Design System. The contractor shall comply with the following FSA brand requirements when creating, designing, developing, writing, updating, and maintaining both information technology products and document products.

FSA Branding requirements apply to all websites and mobile apps, all configured screens within information systems, all mobile application screens, all FSA social media, and all customer-facing documentation/content that is intended for use by students, parents, borrowers, or schools.

Screen mock-ups showing planned FSA Branding shall be submitted for websites, configured screens within information systems, mobile applications, and social media.

Templates and layouts shall be submitted for customer-facing documentation.

FSA may modify or update the FSA brand style guide and design system standards at any time. When such modifications occur, the contractor shall incorporate relevant updates into the next major product release or at another time as agreed by FSA.

The contractor may request a waiver from specific elements of the FSA Brand Style Guide and Design System. FSA will consider such requests and may also work with the contractor to achieve an alternative solution to the specific branding element(s) at issue in the waiver request.

The Contractor shall, after creating new common components or making modifications to existing components within the FSA Design System that could be useful in other projects, contribute the design and code for those components to FSA for inclusion in future design system versions.

A representative for each contractor actively developing an information system or website shall participate in quarterly brand working group meetings while the development cycle is ongoing. The contractor representative shall collaborate and discuss the current and future state of the FSA brand standards and design system, and voice ongoing concerns, needs, and solutioning.

Contractor Support of Technology Refreshment As part of its standard technology refreshment program, FSA requires regularly-scheduled and periodic upgrades of the underlying infrastructure, support software, and enabling frameworks to (at minimum) N-1 versions (where N is the latest version and N-1 is the second latest version).

Software as a Service (SaaS), Platform as a Service (PaaS), and/or Infrastructure as a Service (IaaS) Solutions: The Contractor performing integration services for FSA in connection with Federal Information Security Management Act (FISMA)-approved cloud computing services (SaaS, PaaS, IaaS) shall ensure the infrastructure, support software, and enabling components and frameworks are maintained to (at minimum) N-1 versions as part of a standard technology refreshment program.

Infrastructure and Commercial-Off-The-Shelf (COTS) Software: The Contractor shall support refreshment activities, including infrastructure and software upgrades and patches led by FSA’s infrastructure and middleware vendors. As needed, the Contractor shall regularly support planning and scheduling, impact analysis, changes to the application, and testing.

Applications and Enabling Components and Frameworks: The Contractor shall ensure that functionality and application design are optimized; maintenance is cost efficient; the enabling technology remains under support by third party vendors (e.g. IBM, Oracle, or Microsoft); the application code and its underlying frameworks are maintained at the N-1 or N version. Refer to the Federal Student Aid Technology Standards and Products Guide for additional information.

FSA’s Technology Standards and Product Guide (TSPG) is published at the following URL:

https://studentaid.gov/sites/default/files/fsawg/static/gw/docs/ciolibrary/Technology_Standards_and_Products_Guide.pdf Personnel Security Requirements The contractor shall comply with Department of Education personnel security requirements and policies as set forth below:

· Department of Education Contractor Vetting Security Requirements. Please refer to Internet-published document linked below: https://www2.ed.gov/fund/contract/about/bsp.html

· Positions on this contract that perform the duties of system administrator, database administrator, software/code developer, IT operations support manager, system technicians with administrative privileges, software test manager, quality assurance manager, configuration manager, system analyst, security manager, security analyst, any position with access to vulnerability scan/penetration testing results, customer services manager, project manager, program manager, policy officer, program executive, and any IT-related positions designated as key personnel are required to meet requirements for High Risk/Public Trust Contractor Positions, as described in the Department of Education Contractor Vetting Security Requirements.

Cybersecurity Requirements The contractor shall comply with Department of Education cybersecurity and privacy requirements in the following document:

· Department of Education Security and Privacy Requirements for IT Procurements. Please refer to Internet-published document link: https://www2.ed.gov/fund/contract/about/bsp.html

Any solution making use of cloud services must use Federal Risk and Authorization Management Program (FedRAMP) certified cloud packages and be approved by the Department of Education for use.

The following subsections describe FSA Cybersecurity requirements that supplement the Department of Education Security and Privacy Requirements for IT Procurements. In the event of any conflicting requirements, the Department of Education Security and Privacy Requirements for IT Procurements shall prevail.

The contractor is advised to thoroughly review Department of Education and FSA cybersecurity requirements with a focus on obtaining and maintaining an Authority to Operate (ATO) for the information system that is supported by this contract. Obtaining and maintaining a ATO for a federal information system is a significant responsibility accepted by the contractor in performing the work under this contract. Refer to the ATO 101 slide presentation for a brief, high-level overview of the process. This slide presentation is available at the IT Standards Library: https://studentaid.gov/about/contracting-info/it-standards .

0. FSA General Cybersecurity Requirements

· The Contractor shall ensure the solution is defined, designed, developed, and maintained in a manner such that it implements the cybersecurity requirements and standards. FSA and the Department of Education have implemented a risk-based approach and measurement methodology for each system and the information system’s cybersecurity performance under FSA contracts. The Contractor shall ensure that the FSA system and associated technologies meets all requirements for cybersecurity including but not limited to the cybersecurity scorecard.

· The Contractor shall ensure that they fully participate, and enter in the appropriate agreements, with the FSA and Department of Homeland Security (DHS) Cyber Hygiene programs.

· The Contractor shall designate a Security Manager, who shall serve as a primary contact point regarding security related issues. The Security Manager shall work with the designated Information System Security Officer (ISSO) to ensure that the information system remains secure, vulnerabilities are addressed, and that all required security documentation and reporting is maintained.

· The Contractor shall allow FSA access to FSA information including data schemas, meta data, and other associated data artifacts that are required to ensure FSA can fully and appropriately retrieve FSA information that can be stored, read, and processed; including but not limited to data stored on recovery media, tape backups, images etc.

· The Contactor shall provide a data loss prevention capability to ensure that Controlled Unclassified Information (CUI) and privacy data are monitored and protected.

The contractor’s designated security personnel must obtain an ed.gov account (network/e-mail) and PIV Badge.

The Contractor’s security personnel must obtain access to the government’s Cyber Security Assessment and Management (CSAM) system to provide reporting for the system associated with the scope of this effort. The contractor’s security personnel shall be responsible for maintaining all system security artifacts in CSAM, including, but not limited to, the System Security Plan (SSP).

The Contractor’s security personnel must obtain access to the Department of Education’s PowerBI system (or a future replacement system thereof, if appropriate) where system scorecards are stored for the applicable system that has an Authority to Operate (ATO).

· The Contractor shall be liable for breaches of security resulting from failure to follow Federal, NIST, DHS, ED or FSA security processes and the federal law, guidance documents, and security standards.

0. Authority to Operate The Contractor shall ensure compliance with the Federal Information Security Management Act (FISMA) by authoring and periodically updating FISMA artifacts as changes occur and responding to FISMA-related data calls. The Contractor shall support management of FISMA related activities. Specifically, the Contractor shall:

· Support remediation of security-related issues in FSA’s applications that are impacted by contractor’s scope and deliverables.

· Support handling security incidents related to FSA’s applications that are impacted by contractor’s scope and deliverables.

The Contractor shall certify that the delivered solution complies with the security authorization processes as outlined in National Institute of Standards and Technology Special Publication NIST-SP-800-37 entitled Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, and supporting OCIO policies, standards, and procedures. In accordance with the identified risk rating, the solution shall satisfy the appropriate security controls as defined in Federal Information Processing Standards FIPS 200 and National Institute of Standards and Technology NIST-SP 800-53 entitled Recommended Security Controls for Federal Information Systems and Organizations.

Note – this ATO requirement does not impact any requirement to comply with section Cybersecurity Requirements references.

0. FSA Data Segregation Requirements

· Physical Separation

· Contractor shall provide and maintain a physically segregated network based upon the FSA defined landing zones documented in the FSA Network Operating Standards and the function of systems operating in the FSA environment.

· Contractor shall ensure separate hardware for each landing zone to include, but not limited to network devices, routers, switches, firewalls, and load balancers.

· In non-cloud environments, the contractor shall ensure virtual machines exist on physically separate equipment for each landing zone including virtual routers and switches.

· Logical Separation

· FSA data and transactions on mainframes shall be hosted in separate partitions that do not share resources with other IT users of the mainframe.

· For virtual and cloud environments, the contractor shall ensure FSA systems are hosted in separate instances, also may be referred to as containers, or tenants.

· Monitoring and reporting segregation

· The Contractor shall provide a quarterly report that identifies systems by name and IP address to identify potential problems in maintaining segregation of systems. This reporting shall be accomplished as part of the Hardware Listing deliverable.

· The Contractor shall monthly monitor, track, and report on physical segregation to ensure it is maintained. This reporting of physical segregation shall be accomplished as part of the System Authorization Boundary deliverable.

· The Contractor shall follow an FSA approved process for changes to network configurations.

· The Contractor shall provide a report to validate that moves, additions, and changes have been appropriately requested and implemented. This reporting shall be accomplished through the submission of an updated System Authorization Boundary deliverable when such changes occur.

· The Contractor shall use the change-management process to identify potential security gaps in segregation maintenance and shall report status and findings quarterly. Findings shall be reported by opening a plan of actions and milestones (POA&M) in CSAM.

0. FSA IT Retirement Requirements

· When an Information Resource reaches the end of its life cycle, and access to the resource by all users has been terminated, data resident on the resources shall be protected and transferred to the Government in a usable form within TBD so it is available for future use, and other assets shall be disposed of in accordance with NIST publication 800-88.

· The Contractor shall complete the destruction within an agreed upon timeframe with FSA, but no later than sixty (60) days after the end of the contract performance period or after the contract is suspended or terminated by FSA or by the Contractor for any reason.

· The Contractor must provide FSA with Certification of Secure Destruction of all existing active and archived originals and/or copies of all FSA and FSA-activity-related files and information. The Certification shall be provided by a Third-Party Firm approved in advance by FSA. All costs associated with Certification shall be the sole responsibility of the Contractor.

0. FSA Information Data Exchange

· The Contractor shall provide cybersecurity relevant data, to support Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, in a machine-to-machine manner to the FSA Security Operations Center.

· The Contractor shall implement and maintain Information Security Continuous Monitoring (ISCM) and Continuous Diagnostics and Mitigation (CDM) capabilities for all IT assets to be subject to an automated inventory, configuration, and vulnerability management capability, with real time reporting; CDM data shall be transferred from the contractor to FSA via machine-to-machine interface in real time.

· The Contractor shall implement Internet access via TIC or MTIPS in accordance with OMB Memorandum M-19-26, Update to the Trusted Internet Connections (TIC) Initiative, September 12, 2019.

0. FSA Identity, Credential, and Access Management (ICAM) Requirements

4. General ICAM Requirements

· All contractors accessing ED and FSA networks and/or data centers who are classified as Privileged Users (PU) are required to use government furnished Personal Identity Verification (PIV) cards for authentication and access. Note: FSA prohibits contractors from granting access to FSA systems without approval by the Department.

· The Contractor shall not issue the PIV-I card to the Privileged Users of the FSA system until after FSA has approved access for these users.

· The Contractor shall ensure that all Privileged Users who work on IT resources and applications containing or accessing FSA’s data utilize the PIV cards that their organization secure. The Contractor shall provide card readers and require Privileged Users to use the PIV card for authentication and access to IT resources and applications containing or accessing FSA’s data satisfying an Identity Assurance Level (IAL3) and Authentication Assurance Level 3 (AAL3) as defined in NIST SP 800-63-3.

· The Contractor shall ensure that a Privileged Access Management (PAM) system is utilized for all privileged user access to information systems. The PAM solution will manage access and log user activity. Monthly access logs will be provided to FSA.

· The Contractor shall ensure that websites require multi-factor authentication where necessary.

· The Contractor shall request ed.gov accounts, and ensure PIV cards are issued, for all individuals that require access to Department and/or FSA business information systems, networks, or email accounts.

· For a contractor using a Government Furnished Equipment (GFE) Laptop, the user shall use the Department provided Virtual Private Network (VPN) solution(s).

4. ICAM Reporting Requirements

· The Contractor shall provide a monthly PIV Card report to FSA including:

· Number of privileged users with PIV cards disabled in the last 30 days.

· Number of privileged users with PIV cards enabled in the last 30 days.

· Total number of privileged users with PIV cards.

· The Contractor shall track and retain records of everyone who has approved access (user ID) to the servicing system, including clearances, training, and signed security documents; ensure that necessary clearances do not lapse; and suspend FSA access for anyone not in compliance.

· The Contractor shall provide a monthly PIV and/or PIV-I Card report(s) to FSA including:

· Number of privileged users with PIV-I cards disabled in the last 30 days.

· Number of privileged users with PIV-I cards enabled in the last 30 days.

· Total number of privileged users with PIV-I cards.

· The contractor shall send an email to all FSA System Security Officers at any time one of the contractor’s users is no longer employed or no longer requires access to FSA systems, advising the FSA System Security Officers that the status of the person(s) identified is "no longer employed" or "no longer required access to FSA systems." This email shall be sent at least 5 days prior to an employee's removal from a contract or immediate in cases that require immediate removal of an individual for security or suitability reasons.

4. FSA Identity and Access Management Solutions as the Identity Provider (IdP) To meet the Executive Order 14028: Improving the Nation’s Cybersecurity and the Office of Management and Budget (OMB) Memorandum 22-09 (M-22-09) requires Federal agencies, including FSA, to implement strong MFA solutions as part of the Federal Zero Trust strategy. FSA requires all FSA systems to utilize the centralized FSA Identity and Access Management (IAM) solutions as the identity provider (IdP) for users to accessing FSA systems. FSA IAM has two primary systems Access and Identity Management System (AIMS) for privileged users accessing or supporting internal FSA systems and Person Authentication Service (PAS) for external (public) users accessing FSA systems. The FSA IAM systems provide a centralized identity management solution to an integrated application, system, or service with AIMS and/or PAS respectively. AIMS and PAS will provide a Single Sign-On (SSO) solution to their respective user bases primarily leveraging the standard OpenID connect and OAuth 2.0 standards and protocol. Once the integrated application, system, or service user is authenticated, user access tokens will be provided to support SSO for FSA Applications (Relying Parties (RP)). AIMS and PAS are the OIDC Provider (OP) with the authorization server using OpenID Connect (OIDC) and OAuth 2 protocol for the SSO capabilities. The IAM Solutions will also allow the enhancement of API protection with token management. AIMS also provides the use of System for Cross-domain Identity Management (SCIM) interfaces, to integrate with other Privilege Access Management systems within other FSA Data Centers active directory (AD)/lightweight directory access protocol (LDAP) to meet the Master User Record (MUR) requirements. SCIM interface supports the Continuous Diagnostic Monitoring (CDM) for providing the Credential (CRED), Privilege (PRIV), TRUST and BEHAVE attribute information.

· The FSA Applications (Relying Parties (RP)) shall use the FSA IAM Solutions for as their IdP for provisioning and deprovisioning users.

· The FSA Applications (Relying Parties (RP)) shall use the FSA IAM Solution for Single Sign-On (SSO).

· The FSA Applications (Relying Parties (RP)) shall use the FSA IAM Solution for authentication of users accessing the system.

0. Supply Chain Management: Conformance with OMB M22-18 NIST Software Attestation The contractor shall comply with OMB M22-18 Memorandum to ensure the security and integrity of the software supply chain and safeguard the security of software development environments.

0. FSA Cybersecurity References The contractor shall use the current versions and current revisions for Federal Cybersecurity Laws and Regulations, OMB Memorandums, NIST guidance documents, Department of Homeland Security Guidance documents, Department of Education policy and guidance documents, and Federal Student Aid policy, procedures, and guidance documents.

· The contractor shall implement new requirements due to changes in cybersecurity reference documents as soon as possible after publication of the new requirement(s). Any work due to new requirements that is done at no additional cost to the government shall be coordinated through the Information System Owner and Information System Security Officer.

· Any additional cost for implementing new requirements due to changes in cybersecurity reference documents during the term of the contract must be submitted in writing to the Contract Officer and the contractor must receive approval before proceeding with the work.

Capacity Planning and Management The contractor shall provide capacity planning and management information to the government, including: capacity planning reports and recommendations; annual forecast and recommendations it proposes to adopt in fulfillment of the contract with specific sizes, quantities, specifications and timing.

The contractor shall support FSA’s capacity planning schedule and process. The contractor will provide input relative to the performance of the application/tool and its supporting infrastructure. This will, include but not be limited to system response time and/or latency, system capacity, storage requirements, utilization, performance, etc.

The contractor shall monitor and manage capacity to ensure that information technology resources are being operated within minimum and maximum thresholds.

The contractor shall produce written capacity management reports at intervals stipulated in the deliverables table, which summarize actions taken since the last report and which provide prescriptive recommendations to minimize cost and maximize efficiency.

Data Planning and Management Data Planning The contractor shall provide a Data Migration Plan for solutions that involve the movement, creation, modification, or decommissioning of operations data supporting any Federal Student Aid information system in alignment with the approved federal records schedule and in compliance with the Records Act. Refer to the FSA System Development Lifecycle (FSA SDLC)/Lifecycle Management Methodology (LMM) section of the Federal Student Aid Technology Office IT Standards Library for additional information.

https://studentaid.gov/about/contracting-info/it-standards Data Management The Contractor shall provide detailed file layouts for all production data files, loads, and extracts comprising or supporting any Federal Student Aid information system per the guidance provided in the current Federal Student Aid Data Standardization Policies and Procedures in effect at the time of a request. Additionally, the contractor shall include detailed source target mapping, conceptual (where applicable), logical and physical data models, and detailed data dictionaries for all production database structures per the guidance provided in Federal Student Aid Data Model Standards and Guidelines, Registration Policies and Procedures, and Federal Student Aid Enterprise Data Dictionary Standards in effect at the time of the request. The contractor shall provide this information on an as-needed basis when requested by FSA.

Use of Artificial Intelligence (AI) Technologies

1. The contractor shall explicitly identify all artificial intelligence (AI) technologies implemented within the information system as part of system documentation. Such identification shall include labeling the technology/product as AI technology. As appropriate to the scope of the deliverable, this shall include identification within the following deliverable documents: system authorization boundary, detailed design document, system description, technical description, hardware listing, and software listing.

2. The contractor shall ensure that the information system and the contractor’s supporting work processes remain current and compliant with all relevant federal laws, requirements, and policies relating to the use of artificial intelligence (AI) technologies. The government recognizes that AI Technology is a rapidly evolving legal environment with changing requirements. The contractor shall be responsible for maintaining legal, regulatory, federal, and Department of Education policy compliance for the AI technologies utilized in performance of this contract. Updates to AI technologies and work processes that are necessary to maintain such compliance shall be accomplished at no additional cost to the government.

3. The contractor shall comply with the following federal requirements related to Artificial Intelligence (AI) technologies:

a. Executive Order 13859: Maintaining American Leadership in Artificial Intelligence (February 11, 2019)

b. OMB M-21-06: Guidance for Regulation of Artificial Intelligence Applications (November 17, 2020)

c. Executive Order 13960: Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government (December 3, 2020)

d. NIST AI-100-1: Artificial Intelligence Risk Management Framework (AIRMF1.0) (January 2023)

e. Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (October 30, 2023)

f. Department of Education guidance: Initial Cybersecurity Standard for Usage of Artificial Intelligence (AI) at the Department (October 31, 2023)

g. Draft Policy Guidance on U.S. Government Use of AI. More details on this policy, which is currently available for public comment, can be found at ai.gov/input and https://ai.gov/wp-content/uploads/2023/11/AI-in-Government-Memo-Public-Comment.pdf.

Federal Records and Controlled Unclassified Information (CUI) Contractor must comply with the records management clause within the Department of Education Acquisition Regulations (EDAR) – clause 3452.204-70.

0. Remedies for Contractors Violation of System Security Requirements If PII is improperly disclosed, released to or accessed by an unauthorized system(s) or individual(s), or is otherwise compromised (collectively referred to as PII Breach), or if the Contractor has knowledge of a potential PII Breach, in addition to the requirements elsewhere under this Contract, the Contractor shall immediately:

(1) take all reasonable measures necessary to implement security safeguards to prevent further compromise of PII, improper disclosure of PII, or release of or access of PII by unauthorized systems or individuals.

(2) mitigate any potential harm suffered by those individuals whose PII may have been exposed in a PII Breach (Affected Individuals) once a PII Breach is confirmed and notices to Affected Individuals are sent as provided under the Contract. Such mitigation shall include, at a minimum, data breach protection services (Data Protection Services), including identity theft and credit protection, to all Affected Individuals for a period not less than 18 months from the date of discovery of the improper disclosure. Data Protection Services must include:

i. one year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

ii. data breach analysis;

iii. fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

iv. three years of identity theft insurance with up to $1,000,000.00 coverage at $0 deductible; and

v. reimbursement of necessary legal expenses that Affected Individuals may incur to repair falsified or damaged credit records, histories, or financial affairs.

IT Accessibility Requirements (Section 508 of the Rehabilitation Act) Please note that a hyperlink is included providing guidance on the following statements except for the last bullet relating to acceptance criteria.

· Section 508 of the Rehabilitation Act, as amended by P.L. 105-220, requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Products, platforms and services delivered as part of this work statement that are or contain ICT, must conform to the Revised 508 Standards, at 36 C.F.R. § 1194.1 & Apps. A, C & D. https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

· Applicable Functional Performance Criteria: When using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT. – All requirements apply

· Applicable requirements for software features and components: All WCAG Level AA Success Criteria, 502 Interoperability with Assistive Technology, 503 Application – Applies if client server software (installed on a computer) is a part of the procurement.

· Applicable requirements to Webpage and Web Applications: All WCAG Level AA Success Criteria – Applies if websites or a web-based application (browser based) is part of the procurement.

· Applicable requirements for hardware features and components: Applies if hardware is part of the procurement. (e.g. copiers, fax machines, phones, scanner etc.)

· Applicable support services and documentation: All requirements apply.

· Section 508 Compliance Criteria: Prior to acceptance, the government reserves the right to perform testing on required ICT items to validate the contractor’s Section 508 conformance claims.

· If ED OCIO testing of website implementations and enhancements determines the enhancements fail to meet Section 508 requirements, then final payment for the release may be withheld by the government until the product is updated to pass 508 compliance testing by ED OCIO.

· If the government determines that Section 508 conformance claims for COTS software products provided by the contractor represent a higher level of conformance than what is provided to the agency, the government may, at its option, require the contractor to remediate the item to align with the contractor’s original accessibility (Section 508) conformance claims prior to acceptance, require the contractor to substitute a compliant product, or at the discretion of the contract officer negotiate a reduced payment with the contractor for failure to meet the government’s requirements.

Technology Business Management Data Reporting The Technology Business Management (TBM) Data Report template is included as an attachment to this contract. This report shall be an annual deliverable under this contract with an as-need requirement when the distribution percentages need to be changed at the contractor’s notification. The contractor shall complete all pertinent fields of the report and provide timely delivery consistent with the August due date for the annual Capital Planning and Investment Control (CPIC) submission. The specific deliverable descriptions for the TBM sub-IT Towers and sub-Cost Pools are provided as an attachment to this acquisition.

The contractor shall complete the TBM template (i.e., complete the values in the cells corresponding to sub-IT Towers and sub-Cost Pools) that pertain to their particular contract. Not all IT Towers nor all the Cost Pool categories may apply to the contract. The contractor shall enter the appropriate amounts into each cell for each pertinent fiscal year. The contractor shall ignore any IT Cost Pool for Internal Labor which pertains to Government FTE costs, which will be completed by FSA.

The contractor shall use the current TBM template (MS excel spreadsheet) provided by FSA for data submittal. The template may be modified and updated semi-annually. This template is available at the IT Standards Library: https://studentaid.gov/about/contracting-info/it-standards.

Project, Risk, and Schedule Management and Reporting The contractor shall follow Project, Risk, and Schedule Management best practices and provide relevant deliverables as listed in the deliverable table.

0. Project Management The contractor shall provide project management plans for review upon request.

0. Scheduling The contractor shall maintain a Microsoft Project Schedule (version 2013 or newer) for all program and project schedules delivered under this contract.

All program and project schedules delivered under this contract shall incorporate the following schedule management practices:

1. Capturing all activities - The schedule shall reflect all activities as defined in the work breakdown structure (WBS), which defines in detail the work necessary to accomplish a project’s objectives, including activities both the government and the contractor are to perform.

2. Sequencing all activities - The schedule shall be planned such that critical dates can be met. To do this, activities must be logically sequenced and linked—that is, listed in the order in which they are to be carried out and joined with logic. Each predecessor activity must start or finish before its successor. Date constraints and lags should be minimized and justified. This schedule shall ensure that the interdependence of activities that collectively lead to the completion of activities or milestones can be established and used to guide work and measure progress.

3. Assigning resources to all activities - The schedule should reflect the resources (labor, materials, travel, facilities, equipment, and the like) needed to accomplish the work, whether they will be available when needed, and any constraints on funding or time.

4. Establishing the duration of all activities - The schedule shall realistically reflect how long each activity will take. When the duration of each activity is determined, the same rationale, historical data, and assumptions used for cost estimating should be used. Durations should be reasonably short and meaningful and should allow for discrete progress measurement. Schedules that contain planning and summary planning packages as activities will normally reflect longer durations until broken into work packages or specific activities.

5. Verifying that the schedule can be traced horizontally and vertically - The schedule shall be horizontally traceable, meaning that it should link products and outcomes associated with other sequenced activities. Such links are commonly referred to as “hand-offs” and serve to verify that activities are arranged in the right order for achieving aggregated products or outcomes. The schedule should also be vertically traceable— that is, data are consistent between different levels of a schedule. When schedules are vertically traceable, lower-level schedules are clearly consistent with upper-level schedule milestones, allowing for total schedule integrity and enabling different teams to work to the same schedule expectations.

6. Confirming that the critical path is valid - The schedule shall identify the program’s critical path—the path of longest duration through the sequence of activities. Establishing a valid critical path is necessary for examining the effects of any activity’s slipping along this path. The program’s critical path determines the program’s earliest completion date and focuses the team’s energy and management’s attention on the activities that will lead to the project’s success.

7. Ensuring reasonable total float - The schedule shall identify reasonable total float (or slack)—the amount of time a predecessor activity can slip before the delay affects the program’s estimated finish date—so that the schedule’s flexibility can be determined. The length of delay that can be accommodated without the finish date’s slipping depends on the number of date constraints within the schedule and the degree of uncertainty in the duration estimates, among other factors, but the activity’s total float provides a reasonable estimate of this value. As a general rule, activities along the critical path have the least total float. Unreasonably high total float on an activity or path indicates that schedule logic might be missing or invalid.

8. Conducting a schedule risk analysis - A schedule risk analysis starts with a good critical path method schedule. Data about program schedule risks are incorporated into a statistical simulation to predict the level of confidence in meeting a program’s completion date; to determine the contingency, or reserve of time, needed for a level of confidence; and to identify high-priority risks. Programs should include the results of the schedule risk analysis in constructing an executable baseline schedule.

9. Updating the schedule using actual progress and logic - Progress updates and logic provide a realistic forecast of start and completion dates for program activities. Maintaining the integrity of the schedule logic is necessary to reflect the true status of the program. To ensure that the schedule is properly updated, the contractor shall ensure that the staff assigned responsibility for the updating should are trained in critical path method scheduling.

10. Maintaining a baseline schedule - A baseline schedule is the basis for managing the program scope, the time period for accomplishing it, and the required resources. The baseline schedule is designated the target schedule and is subjected to a configuration management control process. Program performance is measured, monitored, and reported against the baseline schedule. The schedule should be continually monitored so as to reveal when forecasted completion dates differ from baseline dates and whether schedule variances affect downstream work. A corresponding basis document explains the overall approach to the program, defines custom fields in the schedule file, details ground rules and assumptions used in developing the schedule, and justifies constraints, lags, long activity durations, and any other unique features of the schedule.

The contractor’s personnel responsible for managing schedules shall reference the U.S. Government Accountability Office (GAO) Schedule Assessment Guide (SAG) https://www.gao.gov/assets/680/674404.pdf for detailed guidance on schedule management practices.

0. Risk Management The contractor shall submit Risk Management Plan(s) and Risk Log(s) referenced in the deliverables table, and shall review risk plans, logs and registers with FSA on a quarterly basis.

Quality Control Quality Control Plan The Contractor shall ensure quality service is maintained throughout the life of the contract and shall prepare and implement (upon Government approval) a Quality Control Plan. The plan shall reflect the Contractor’s overall approach, internal controls, and establishment of procedures for evaluating each service under the scope of this contract (who, method, how often), for reporting to the Government, for resolving deficiencies, for identifying potential improvements, and for maintaining and making available to the Government, documentation (as listed in Deliverables Section) reflecting quality control inspections and any corrective actions taken.

Period of Performance

TBD

Deliverables

TBD

Functional Software/System Deliverables

Documentation Deliverables